The WP-Lister Lite for eBay WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) in the 'orderby' parameter in all versions up to 3.8.8. The issue arises from improper neutralization of special elements in SQL commands, specifically insufficient escaping of user-supplied input and lack of prepared statements. Authenticated attackers with shop manager or higher privileges can append arbitrary SQL queries to existing ones, potentially extracting sensitive data from the database. No known exploits are reported in the wild, and no official remediation level or patch is currently documented.

An attacker with shop manager-level or higher privileges can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL commands. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The vulnerability requires authenticated access, limiting exposure to users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager-level access to trusted users only and monitor for suspicious activity related to the 'orderby' parameter usage. Avoid exposing this parameter to untrusted inputs where possible.