The plugin suffers from an arbitrary file upload flaw caused by missing or incomplete file type validation. The putFile function in the code accepts any file name with an executable extension because sanitize_file_name() does not strip such extensions and there is no allow‑list, MIME check or safe‑extension rename. As a result, an authenticated user with subscriber‑level or higher privileges can upload executable files, allowing an attacker to place malicious code on the server and trigger remote code execution.

Yaycommerce’s YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is affected, with all versions up to and including 2.7.7. No later versions are known to be impacted and no other products from the vendor are listed.

The CVSS score of 8.8 classifies the vulnerability as High, and the EPSS score of 0.00575 (<1%) indicates a very low probability of exploitation by the general population. The plugin’s sole server‑side guard is a .htaccess file containing 'Require all denied', but this rule is silently ignored by nginx and by Apache configured with AllowOverride None, making the risk of remote code execution fully realizable on those server configurations. Because the flaw requires authentication, the attacker must be able to log in as a subscriber or higher, but once access is achieved, uploading the file is sufficient to execute code.