A high-severity SQL injection vulnerability in the YayCommerce SMTP for Amazon SES plugin could allow an authenticated attacker with high privileges to compromise database integrity.

This vulnerability is a classic SQL injection (CWE-89) arising from the improper neutralization of special elements within SQL commands. The vulnerability requires high-level administrative privileges to execute the malicious queries.

Successful exploitation of this flaw allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exfiltration or system instability. Given the CVSS score of 7.6, this represents a significant risk to organizational data confidentiality and operational continuity, necessitating prompt remediation to prevent potential misuse of the database layer.

Immediate Action: Upgrade to the latest available version of the YayCommerce SMTP for Amazon SES plugin that addresses this vulnerability.

Proactive Monitoring: Monitor database query logs for unusual syntax patterns or unexpected access requests originating from administrative accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads.

Public Exploit Available: Unknown

The vulnerability presents a substantial risk due to the potential for direct database interaction. Security teams should prioritize updating the affected plugin immediately to ensure that this injection vector is effectively neutralized.