The plugin contains an SQL Injection vulnerability that allows an unauthenticated user to inject arbitrary SQL via the smtp-sendgrid interface. This flaw can lead to read, modification, or deletion of database records, potentially exposing sensitive site data or allowing further exploitation such as remote code execution. The weakness is classified as CWE-89.

WordPress sites running YayCommerce SMTP for SendGrid – YaySMTP plugin versions from the initial release through 1.5 are affected. All installations that have not applied the latest update are at risk.

The CVSS score of 7.6 indicates a high impact vulnerability, while the EPSS score of less than 1% shows a low probability of active exploitation at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request sent to the plugin’s endpoint, which the plugin fails to sanitize. As no specific authentication requirement is described, the vulnerability could be exploited by anyone with network access to the WordPress site.