The onOffice for WP-Websites plugin is vulnerable to a SQL Injection flaw that originates from the "order" parameter. Unsanitized input combined with a lack of prepared statements enables an authenticated user with Editor privileges or greater to append arbitrary SQL commands to existing queries, allowing extraction of sensitive data stored in the WordPress database and compromising confidentiality.

All installations of the onOffice for WP-Websites plugin whose version is 6.5.1 or older are affected. The provided data does not indicate that any newer release fixes the issue, so all such installations must be treated as vulnerable until the vendor supplies a corrected version.

The CVSS score of 4.9 places the vulnerability in a medium severity range, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. Compromise requires authenticated access with at least Editor privileges, limiting the attack surface. The flaw is not listed in the CISA KEV catalog. Nevertheless, an attacker who gains or controls an Editor account could read protected database content and potentially facilitate further attacks.