This vulnerability in YayMail arises from improper neutralization of special elements used in SQL commands, leading to Blind SQL Injection. It affects YayMail versions up to 4.3.3. The issue allows attackers to inject SQL code that can be executed by the database, potentially compromising data integrity or confidentiality. No CVSS score or detailed vendor advisory is currently available, and no patch or mitigation guidance has been published.

Successful exploitation could allow an attacker to perform unauthorized SQL queries on the database used by YayMail, potentially leading to data leakage, modification, or other impacts typical of SQL injection vulnerabilities. However, no known exploits in the wild have been reported, and the exact impact depends on the database and environment configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from YayCommerce and consider applying any recommended temporary mitigations once available. No vendor advisory indicating 'no action required' or 'already mitigated' is present.