Threats tagged 'ghsa-p863-v42w-vwcc'

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress contains a time-based SQL Injection vulnerability in the 'params[searchKey]' parameter. This affects all versions up to and including 2.7.8. The flaw allows authenticated users with administrator-level privileges or higher to inject additional SQL queries due to insufficient escaping and lack of proper query preparation. This can lead to unauthorized extraction of sensitive database information.