CVE-2026-109977 · Package
NO FIX YET · SEE WHAT TO DO
The YaySMTP WP Mail SMTP plugin for WordPress does not escape the params[searchKey] parameter before using it in a SQL query, in all versions up to and including 2.7.8. An authenticated administrator can append SQL queries and extract sensitive data from the site database.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the YaySMTP plugin for WordPress up to and including 2.7.8. Exploitation requires an account with administrator-level access or above, so the risk sits with who holds admin rights on the site. Sites without this plugin are not affected.
Not affected if admin-accounts-trusted, plugin-not-installed
Who cares wordpress, wordpress-plugin, yaysmtp
2.7.8 are described as affected.The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.