CVE-2024-52436 describes a Blind SQL Injection vulnerability in the Post SMTP plugin for WordPress developed by Saad Iqbal. The vulnerability arises from improper neutralization of special elements in SQL commands, allowing an attacker with high privileges to execute crafted SQL queries that can disclose sensitive information (confidentiality impact is high). The vulnerability affects all versions up to 2.9.9. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change. There is no indication of an official patch or vendor advisory at this time.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive database information due to Blind SQL Injection. The confidentiality impact is high, meaning sensitive data could be exposed. Integrity is not impacted, and availability impact is low. The attack requires high privileges, limiting the attack surface to authenticated users with elevated rights. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to users with high privileges and monitor for suspicious activity related to SQL queries in the Post SMTP plugin. Avoid granting unnecessary high privileges to users. Do not rely on generic mitigations; follow vendor updates closely.