SQL Injection Vulnerability in YaySMTP Plugin for WordPress
CVE-2026-109977

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Yaysmtp – WP Mail Smtp With Email Logs, Tracking & Reports
Vendor
CVE Published:
6 November 2026

What is CVE-2026-109977?

The YaySMTP plugin, utilized for managing email settings within WordPress, is vulnerable to a time-based SQL Injection. This vulnerability arises from inadequate escaping of the 'params[searchKey]' parameter, which allows authenticated users with administrator-level access to manipulate existing SQL queries. By exploiting this weakness, attackers can append malicious SQL commands, potentially extracting sensitive data from the database. All versions up to and including 2.7.8 are impacted, posing significant risks to WordPress installations using this plugin.

Affected Version(s)

YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports 0 <= 2.7.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/yaysmtp/tags/2...
https://plugins.trac.wordpress.org/browser/yaysmtp/tags/2...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.