Check & Log Email, a WordPress plugin, contains a flaw in the handling of request parameters "d" and "s" that permits administrator‑level users to inject arbitrary SQL. The vulnerability allows reading, modifying, or deleting data in the plugin’s tables, thereby compromising the confidentiality, integrity, and availability of the site’s data. The weakness is a classic SQL injection (CWE-89).

WordPress sites running Check & Log Email versions prior to 2.0.15 are vulnerable. Only administrators who can submit values for the "d" and "s" parameters from the plugin’s configuration pages can exploit the flaw.

An attacker must be authenticated as an administrator to reach the vulnerable code, so remote unauthenticated exploitation is not possible. The CVSS score of 6.5 indicates a moderate to high impact, and the EPSS score of < 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, meaning no known active exploits are documented. Based on the description, it is inferred that if exploited, an attacker could execute arbitrary SQL commands through the plugin, potentially reading, modifying, or deleting data in the plugin’s tables. The extent of impact depends on the attacker’s privileges and the specific database schema used.