Improper neutralization of special elements in SQL commands allows an attacker to inject arbitrary SQL through the YayCommerce SMTP for Amazon SES plugin. This flaw can expose, modify, or delete database contents, potentially leading to data breach, credential theft, or disruption of critical services. The vulnerability is a classic SQL injection, classified as CWE-89, enabling attackers to manipulate queries and gain unauthorized access to sensitive information.

WordPress sites using YayCommerce’s SMTP for Amazon SES plugin version 1.9 or earlier.

The vulnerability carries a CVSS score of 7.6, indicating a high impact if exploited. Its EPSS score is less than 1%, indicating a low probability of exploitation at present, and it is not listed in the CISA KEV catalog. Attackers likely gain access through the web interface by submitting malicious input in the plugin’s email form or configuration fields, with the plugin’s code inserting that input directly into database queries without proper parameterization or escaping. Successful exploitation could allow an attacker to exfiltrate data, corrupt records, or in some cases elevate privileges, depending on database credentials and associated permissions.