The vulnerability allows an attacker with administrator or higher WordPress credentials to inject additional SQL statements through the params[searchKey] parameter. By crafting a payload, the attacker can cause a time-based SQL injection that retrieves sensitive data from the database. The weakness stems from insufficient escaping and the use of unprepared statements, which enables arbitrary query execution without authentication beyond administrative access.

This issue exists in the YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress versions up to and including 2.7.8. Users who have installed or are running these plugin releases are affected.

The CVSS score of 4.9 places the vulnerability in the medium severity range. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, yet the requirement for administrator-level authentication limits the attacker pool. The likely attack vector is a web request to the plugin’s import settings endpoint where the params[searchKey] parameter is passed. Given the need for authenticated access, an exploit would typically arise from compromised credentials or insider threats. Overall, the risk is moderate, but any environment that relies on this plugin should prioritize remediation.