# YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'searchKey' Parameter

- **ID:** WPSEC-2026-2376
- **Plugin:** YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports (`yaysmtp`), https://wordpress.org/plugins/yaysmtp/
- **Affected versions:** from 2.4.9 before 2.7.9
- **Fixed in:** 2.7.9 (Update to 2.7.9 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yaysmtp
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2376/

## Description

The YaySMTP plugin for WordPress is vulnerable to SQL Injection via the 'searchKey' parameter of the email log CSV export (yaysmtp_export_email_log AJAX action) in versions 2.4.9 up to, and including, 2.7.8, due to the user-supplied column name being concatenated directly into the SQL WHERE clause without validation or escaping and without sufficient preparation of the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On multisite installations this lets a sub-site administrator read data of the whole network, including the network's user table.

## References

- https://wpsec.com/vuln/WPSEC-2026-2376/
- https://plugins.svn.wordpress.org/yaysmtp/tags/2.7.9/
- https://wordpress.org/plugins/yaysmtp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2376/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.