{
 "id": "WPSEC-2026-2376",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2376/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2376/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2376/index.md",
 "title": "YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'searchKey' Parameter",
 "description": "The YaySMTP plugin for WordPress is vulnerable to SQL Injection via the 'searchKey' parameter of the email log CSV export (yaysmtp_export_email_log AJAX action) in versions 2.4.9 up to, and including, 2.7.8, due to the user-supplied column name being concatenated directly into the SQL WHERE clause without validation or escaping and without sufficient preparation of the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On multisite installations this lets a sub-site administrator read data of the whole network, including the network's user table.",
 "plugin": {
  "slug": "yaysmtp",
  "name": "YaySMTP",
  "full_name": "YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports",
  "wordpress_org": "https://wordpress.org/plugins/yaysmtp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yaysmtp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yaysmtp"
 },
 "type": "SQLI",
 "cwe": [
  "CWE-89"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.4.9",
    "from_inclusive": true,
    "to": "2.7.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.4.9 before 2.7.9"
  ]
 },
 "introduced_in": "2.4.9",
 "fixed_in": "2.7.9",
 "remediation": "Update to 2.7.9 or later.",
 "fix_released": "2026-11-01T16:52:21+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:40:59.980534+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2376/",
  "https://plugins.svn.wordpress.org/yaysmtp/tags/2.7.9/",
  "https://wordpress.org/plugins/yaysmtp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yaysmtp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}