CVE-2026-0806 is an SQL Injection vulnerability in the WP-ClanWars plugin for WordPress affecting all versions up to and including 2.0.1. The issue arises from improper neutralization of special elements in the 'orderby' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated attackers with administrator privileges can exploit this to append malicious SQL commands, potentially extracting sensitive data from the database. The vulnerability has a CVSS v3.1 base score of 4.9, reflecting medium severity with network attack vector, low attack complexity, and high privileges required.

Successful exploitation allows authenticated administrators to perform SQL Injection attacks via the 'orderby' parameter, potentially leading to unauthorized access to sensitive database information. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high. There are no known public exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for unusual database queries related to the 'orderby' parameter. Avoid using the vulnerable plugin version if possible.