SZB-14ebebd62e
EUVD lists PHP object injection in YayMail up to 4.4.6 (EUVD-2026-112947)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- yaycommerce
- Product
- YayMail
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a PHP Object Injection flaw in YayMail versions 4.4.6 and earlier, scored 7.2/10 under CVSS v3.1. The item is an automated EUVD alert and does not describe exploitation.
If you use yaycommerce
Check whether YayMail 4.4.6 or earlier is installed on your store
Update to a vendor release that fixes the issue once available
Limit shop manager accounts to trusted staff
What the sources say 1
· Mastodon: “Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.” Source