Cyber Resilience

CVE-2026-39496

High

Published: 08 April 2026

Published
08 April 2026
Modified
24 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0004 12.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-39496 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 12.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-39496 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the YayCommerce YayMail (yaymail) WordPress plugin. The issue affects YayMail versions from n/a through 4.3.3 and was published on 2026-04-08.

The vulnerability has a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating exploitation over the network with low complexity but requiring high privileges, no user interaction, and a changed scope. High-privilege users, such as authenticated administrators, can exploit it remotely to achieve high confidentiality impact by extracting sensitive data from the database through blind SQL injection techniques, alongside low availability impact.

The Patchstack advisory provides details on this SQL injection vulnerability in the WordPress YayMail plugin version 4.3.3.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.This issue affects YayMail: from n/a through <= 4.3.3.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

The blind SQL injection vulnerability directly enables extraction of sensitive data from the database by high-privilege users, mapping to data collection from databases.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-30571Shared CWE-89
CVE-2024-57775Shared CWE-89
CVE-2026-29081Shared CWE-89
CVE-2026-48232Shared CWE-89
CVE-2025-30791Shared CWE-89
CVE-2026-32366Shared CWE-89
CVE-2024-57770Shared CWE-89
CVE-2025-23784Shared CWE-89
CVE-2025-22710Shared CWE-89
CVE-2025-31466Shared CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires information input validation and error handling at interfaces to neutralize special elements used in SQL commands, preventing blind SQL injection in the YayMail plugin.

SI-2 Flaw Remediation good match
prevent

Mandates timely flaw remediation, including patching the vulnerable YayMail WordPress plugin versions through 4.3.3 to eliminate the SQL injection vulnerability.

RA-5 Vulnerability Monitoring and Scanning partial match
prevent

Vulnerability monitoring and scanning identifies SQL injection vulnerabilities like CVE-2026-39496 in web plugins, enabling proactive remediation.

References