YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'searchKey' Parameter
- ID
- WPSEC-2026-2376
- Plugin
- YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports (yaysmtp)
- Affected
- from 2.4.9 before 2.7.9
- Remediation
- Update to 2.7.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- YaySMTP on WPSec AttackSurface
- Fix released
- Published
Description
The YaySMTP plugin for WordPress is vulnerable to SQL Injection via the 'searchKey' parameter of the email log CSV export (yaysmtp_export_email_log AJAX action) in versions 2.4.9 up to, and including, 2.7.8, due to the user-supplied column name being concatenated directly into the SQL WHERE clause without validation or escaping and without sufficient preparation of the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On multisite installations this lets a sub-site administrator read data of the whole network, including the network's user table.
References
- https://wpsec.com/vuln/WPSEC-2026-2376/
- https://plugins.svn.wordpress.org/yaysmtp/tags/2.7.9/
- https://wordpress.org/plugins/yaysmtp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS