The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/