The plugin contains a classic SQL injection flaw exposed through the orderBy parameter. The code concatenates user input directly into an SQL statement without proper escaping or parameter binding. A malicious authenticated user with Contributor-level privileges can supply crafted input to terminate the original query and append a second SELECT or other statements, thereby reading rows from database tables.

WordPress sites running the Broken Link Checker by AIOSEO plugin, versions 1.2.3 and earlier. Any site that has installed this plugin and has users with Contributor or higher roles is at risk.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score (<1%) suggests a low current exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog. However, the requirement of Contributor-level access means that attackers must already have authenticated credentials, which may be a realistic target for social engineering or credential reuse. If exploited, an attacker could read arbitrary data from the WordPress database, potentially exposing user accounts, content, and sensitive configuration information.