The vulnerability is an SQL injection flaw in the YaySMTP plugin for WordPress, allowing an attacker to inject arbitrary SQL commands. This can result in unauthorized disclosure, alteration, or deletion of database contents, compromising the confidentiality and integrity of the system. The flaw arises from insufficient sanitization of special characters used within SQL statements.

Affected products are the YayCommerce YaySMTP plugin for WordPress. All releases up to and including version 2.6.6 are vulnerable; versions from 2.6.7 onward are not affected.

The CVSS score of 7.6 indicates a high severity, and the EPSS score of less than 1% suggests the exploitation probability is low at present. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote web request that submits crafted input to a vulnerable parameter within the plugin’s functionality. Successful exploitation would depend on the attacker having network access to the WordPress site and the plugin being exposed to unauthenticated or authenticated users depending on the affected endpoint.