The WP-Lister Lite for eBay plugin for WordPress is affected by a SQL Injection vulnerability (CWE-89) in the 'orderby' parameter. This occurs because the plugin does not properly escape or prepare the user-supplied 'orderby' parameter before including it in SQL queries. Authenticated attackers with administrator or higher privileges can exploit this flaw to append arbitrary SQL commands to existing queries, potentially extracting sensitive data from the database. The vulnerability affects all versions up to and including 3.8.8. No known exploits in the wild have been reported, and no official remediation or patch has been documented as of the publication date.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection via the 'orderby' parameter, enabling unauthorized extraction of sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator-level access to trusted users only and monitor for unusual database activity related to the 'orderby' parameter. Avoid using vulnerable versions in production environments if possible.