The plugin Email Tracker suffers from an SQL Injection flaw triggered by the 'orderby' parameter. Insufficient escaping and lack of prepared statements allow an attacker with Administrator-level access to inject and execute arbitrary SQL commands. The resulting impact is the unauthorized extraction of sensitive data from the WordPress database, constituting a data exposure vulnerability.

WordPress sites using the Email Tracker plugin version 5.3.15 or earlier are affected. The vulnerable vendor is pmbaldha and the product is Email Tracker. All releases up to and including 5.3.15 contain the flaw.

The CVSS score of 4.9 indicates a moderate severity. The EPSS score is below 1%, reflecting a very low probability of exploitation in the wild. The vulnerability requires authenticated access at the Administrator level, so the attack surface is limited to sites where such credentials exist. The flaw does not appear in the CISA KEV catalog, and no widespread exploitation has been reported.