An authenticated attacker with administrator privileges can exploit the ReportAttacks plugin's insufficiently sanitized 'orderby' parameter, which allows SQL injection. The flaw resides in all plugin versions up to 2.32, enabling malicious SQL to be appended to legitimate queries and thereby read or manipulate sensitive database content. The vulnerability is a classic input injection problem (CWE-89) that grants an attacker unauthorized data exposure.

The affected product is the WordPress Report Attacks and Login Protection plugin developed by sminozzi. Every release of the plugin through version 2.32 is vulnerable, so any WordPress site running this plugin at the affected levels is at risk. Administrators or higher-privileged users can trigger the injection via the web interface that uses the 'orderby' query string parameter.

The client-facing CVSS score of 4.9 indicates a medium-severity issue, while the extremely low EPSS of <1% reflects a very small likelihood of exploitation in the wild. Because the flaw requires authenticated access, attackers must first compromise an administrative account or have existing credentials. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits are documented. However, the combination of limited exploitation window and potential to extract data keeps it a significant concern for sites with the plugin installed.