The vulnerability is a classic SQL Injection flaw in the WordPress YayMail plugin. Input supplied to the plugin is not properly sanitized before being incorporated into an SQL query, allowing an attacker to perform blind SQL Injection. If exploited, an attacker can extract, modify, or delete database records, compromising the confidentiality and integrity of the site’s data.

YayCommerce provides the YayMail plugin for WordPress. Versions from the earliest available through 4.3.3 are affected, meaning any installation using YayMail 4.3.3 or older is at risk.

The CVSS score of 7.6 indicates a high severity. The EPSS score of less than 1% suggests limited public exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via HTTP requests targeting the plugin’s database query endpoints. An attacker would need to craft a malicious payload that bypasses the plugin’s intended input validation; the blind nature of the injection means probing can be performed without immediate visibility into results, making detection more difficult.