The My Auctions Allegro plugin for WordPress contains an SQL injection flaw in the 'order' parameter. The input is not properly escaped and the existing database query is built without prepared statements, allowing attackers who are authenticated with at least Administrator privileges to append arbitrary SQL statements. This flaw can be exploited to read sensitive data from the database, such as user information, order details, or any other stored information.

The affected product is the WordPress plugin My Auctions Allegro, distributed by wphocus. All released versions up to and including version 3.6.31 are vulnerable. Any WordPress installation that hosts one of these versions of the plugin is at risk.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The vulnerability is listed as not in the CISA KEV catalog. Because the flaw requires administrative access, an attacker must already have legitimate credentials or gain them through other means before issuing a malicious request. Once the proper privileges are in place, injecting malicious SQL via the 'order' parameter can result in data extraction. No public exploit or evidence of widespread attacks is reported.