The vulnerability is a blind SQL injection flaw in the YaySMTP WordPress plugin, identified as CWE-89. User supplied data is concatenated directly into SQL statements without proper sanitization or parameterization, allowing attackers to inject arbitrary SQL commands. Successful exploitation could read, modify, or delete sensitive data stored in the WordPress database, compromising confidentiality and integrity.

The YaySMTP plugin released by YayCommerce for WordPress is affected from the earliest available build through version 2.6.4. Any WordPress site running one of these plugin versions is vulnerable.

The CVSS score of 7.6 signifies a high severity vulnerability, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers could target the plugin’s web interfaces or REST API endpoints to trigger the blind injection, and the description does not mention any privilege escalation requirements, so it is unclear whether elevated privileges are needed.