The WPNakama plugin for WordPress contains a time‑based SQL injection flaw in the 'order_by' parameter. Because the input is insufficiently escaped and the query is not prepared, unauthenticated attackers can inject additional SQL code. This enables them to extract sensitive data from the database, potentially exposing user credentials, content, and configuration details. The weakness is an instance of SQL injection (CWE‑89).

WordPress sites using the WPNakama plugin from qdonow, including all plugin versions up to and including 0.6.3. The vulnerability exists in the API and core plugin files; any site that has these files is affected. Specific versions: 0.6.3 and earlier; version 0.6.4 and later are not affected.

The vulnerability has a CVSS score of 7.5, indicating high severity. The EPSS score is <1%, suggesting exploitation probability is currently low. It is not in CISA’s KEV catalog. Attackers need only send a crafted HTTP request containing an 'order_by' parameter; authentication is not required. Successful exploitation could dump database tables or execute arbitrary SELECT statements, giving attackers read‑only access to database contents.