The Post SMTP WordPress plugin (up to version 2.9.3) suffers from a time-based SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in the 'selected' parameter. Authenticated attackers with administrator access can inject additional SQL commands into existing queries because of insufficient escaping and lack of prepared statements. This vulnerability can be exploited to extract sensitive information from the database, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with administrator-level access can exploit this vulnerability to execute arbitrary SQL queries on the database, potentially extracting sensitive information or modifying data. This compromises the confidentiality, integrity, and availability of the affected system's data. Since exploitation requires high privileges, the risk is limited to users who already have significant access, but the impact on the system can be severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using affected versions of the plugin in sensitive environments if possible.