CVE-2026-92553 yaycommerce CVE debrief

Who should care

Defenders responsible for WordPress installations using the vulnerable YaySMTP plugin version should assess exposure and prioritize verification of server configurations. They should also consider the potential impact on their organization's security posture and take steps to mitigate the vulnerability.

Why it matters

CVE-2026-92553 is a high-severity vulnerability in the YaySMTP plugin for WordPress, allowing authenticated attackers to upload potentially executable files, leading to remote code execution. Defenders should prioritize verifying exposure and assessing server configurations.

• Remote code execution possible for authenticated attackers with subscriber-level access and above
• Server-side guard .htaccess file may be silently ignored by nginx and Apache with AllowOverride None configurations
• Verification of exposure and server configuration is necessary to determine risk

Technical summary

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the vulnerable YaySMTP plugin version and assess the server configuration to determine if the .htaccess guard is effective.

Recommended defensive actions

• Verify WordPress installations for the vulnerable YaySMTP plugin version
• Assess server configuration to determine if the .htaccess guard is effective
• Consider upgrading to a patched version of the plugin
• Monitor for suspicious file uploads and system changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including the affected plugin version and the insufficient file type validation in the putFile function. Defenders should verify the exposure of WordPress installations using the vulnerable YaySMTP plugin version and assess server configurations. The .htaccess file containing 'Require all denied' may be silently ignored by nginx and Apache with AllowOverride None configurations, potentially allowing remote code execution. Evidence is limited to public CVE and NVD data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.