The coreActivity plugin for WordPress contains an SQL Injection flaw that can be exploited through the ‘order’ and ‘orderby’ parameters in versions 2.7 and earlier. Because the plugin builds its query without sufficient escaping or parameterization, an authenticated user with Subscriber level or higher can inject additional SQL statements and read sensitive data from the database. This vulnerability is a classic example of CWE‑89 due to unsafe query construction.

The vulnerability affects the gdragon coreActivity: Activity Logging for WordPress plugin, specifically all releases up to and including version 2.7. Users of the plugin on any WordPress site that have Subscriber or higher privileges are at risk.

With a CVSS score of 6.5 the flaw is considered moderate in severity. Its EPSS score of less than 1% suggests that it is unlikely to be actively exploited in the wild, and it is not listed in CISA’s KEV catalog. Nevertheless, because the exploit requires only an authenticated account and is driven by standard plugin parameters, any potential attacker with Subscriber access could utilize it to read confidential database contents.