The xjb REST API TO MiniProgram WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and preparation of the 'order' parameter in the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint. This allows unauthenticated remote attackers to append malicious SQL queries to existing database queries, potentially exposing sensitive data. The issue affects all versions up to 4.7.1. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No patch or vendor advisory is currently provided, and no known exploits in the wild have been reported.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks via the 'order' parameter, potentially extracting sensitive information from the backend database. The confidentiality of data is at high risk, but integrity and availability are not impacted according to the CVSS vector. This could lead to data leakage from the affected WordPress plugin's database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the vulnerable REST API endpoint if possible. Monitor for updates from the plugin vendor or WordPress security advisories to apply any forthcoming patches promptly.