Description

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-11-06T10:16:34.457Z",
  "pubdate": "2026-11-06T10:16:34.457Z",
  "executiveSummary": "The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress contains a critical time-based SQL injection vulnerability within its search functionality. This security flaw, present in all versions up to and including 2.7.8, stems from improper sanitization and lack of parameterized query usage when handling the 'params[searchKey]' parameter.\nThe vulnerability allows authenticated attackers with administrator-level privileges to perform arbitrary SQL query injection. By manipulating the 'params[searchKey]' input, an attacker can append malicious SQL commands to the existing database queries executed by the plugin. This enables the extraction of sensitive information, such as user credentials, configuration data, or private site content, by observing variations in server response times.\nGiven the requirement for administrative privileges, the exploit vector is restricted to authenticated users with high-level access. However, in environments where multiple administrators exist or where account compromise has occurred, this vulnerability poses a significant risk to the integrity and confidentiality of the entire WordPress database. Immediate remediation is required to prevent unauthorized data exfiltration and potential database manipulation.",
  "technicalDetails": "The vulnerability is identified as a time-based SQL injection residing in the 'params[searchKey]' parameter of the YaySMTP plugin. The root cause is the failure to utilize prepared statements or appropriate data sanitization mechanisms before incorporating user-supplied input into database queries. By failing to escape the input, the plugin allows an attacker to break out of the intended query context and introduce secondary SQL commands.\nThe exploitation method relies on time-based inference. An attacker crafts a payload containing SQL functions such as SLEEP() or BENCHMARK() combined with conditional logic (e.g., CASE or IF statements). When the server processes the injected query, the conditional logic evaluates user-defined criteria against the database schema. If the condition is met, the database engine is instructed to delay the response for a specified duration.\nThe attack flow follows a structured pattern: 1) The attacker authenticates as an administrator and navigates to the YaySMTP interface where the vulnerable search parameter is processed. 2) The attacker intercepts the request or directly manipulates the 'params[searchKey]' parameter to include the malicious SQL payload. 3) The application forwards this input to the database layer without sufficient validation, executing the injected query. 4) By measuring the time taken for the server to respond to these requests, the attacker can systematically infer data byte by byte, bypassing standard display mechanisms that might otherwise restrict output.\nThe vulnerable component handles searching and filtering of email logs, which necessitates database interaction. Because the 'params[searchKey]' input is directly reflected in the WHERE or LIKE clauses of the underlying SQL statement, the query structure is fundamentally altered. This permits not only data exfiltration but potentially broad control over the application's database interactions, depending on the privileges of the database user account used by the WordPress instance.\nPost-exploitation impact is severe, as it facilitates unauthorized access to the application's data layer. While the attack is limited to time-based blind extraction, the automated nature of such tools makes the recovery of sensitive information, such as hashed passwords from the wp_users table or secret configuration keys, feasible for a persistent attacker."
}