The CBX Bookmark & Favorite plugin for WordPress contains a generic SQL Injection vulnerability that originates from an insufficiently escaped `orderby` query parameter. An attacker who is authenticated with at least Subscriber level privileges can include additional SQL fragments in that parameter, allowing the attacker to augment the original clause and run arbitrary queries against the WordPress database. This can result in the extraction of sensitive information, such as user credentials or site content, and compromises confidentiality and integrity. The flaw is a classic CWE‑89 injection weakness that arises because the application fails to properly prepare or sanitize user input before incorporating it into a database request.

The vulnerability affects all versions of the CBX Bookmark & Favorite WordPress plugin up to and including 2.0.4. The problem was discovered in the plugin developed by manchumahara, and no other product versions are listed as affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of 6% suggests that the exploit has a non‑negligible probability of being employed in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must possess at least Subscriber level access to exploit the flaw, but the permissiveness of the platform means many sites may grant these rights; once authenticated, the attacker can manipulate the orderby parameter and extract data, potentially across the entire database. Given the lack of an immediate public fix, the risk remains significant for sites that have not upgraded their plugin.