CVE-2026-109977

Name of the Vulnerable Software and Affected Versions YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports versions prior to 2.7.9

Description Authenticated attackers with administrator-level access and above can perform a time-based SQL Injection. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. By manipulating the params[searchKey] parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

Recommendations Update YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports to version 2.7.9 or later. As a temporary mitigation, restrict access to the administrative functions that utilize the params[searchKey] parameter.