The Check & Log Email WordPress plugin prior to version 2.0.15 contains a SQL injection vulnerability (CWE-89) due to improper sanitization and escaping of input parameters before their use in SQL queries. This vulnerability permits users who have administrator privileges to inject malicious SQL code, which can compromise the confidentiality and integrity of the database. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and high impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch available at this time.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure or modification of sensitive data within the WordPress environment. The vulnerability does not affect availability but impacts confidentiality and integrity significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL queries in the plugin. Avoid using affected versions of the plugin in sensitive environments if possible.