The Simple Download Monitor WordPress plugin is vulnerable to a time‑based SQL Injection via the "order" parameter in its Log Export feature. This flaw stems from insufficient escaping and lack of prepared statements, allowing an attacker to inject additional SQL statements. The impact is the potential extraction of sensitive database information. The weakness is classified as CWE‑89 (SQL Injection).

All installations of the Simple Download Monitor plugin with versions up to and including 3.9.33 are affected. An attacker must be a WordPress user with Contributor-level access or higher, and they also need the permissions granted by an Administrator to exploit the vulnerability.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access: a Contributor with the necessary permissions can inject arbitrary SQL via the order parameter, potentially compromising database confidentiality. Due to the moderate CVSS and low EPSS, the risk is considered moderate but should be addressed promptly to prevent possible future exploitation.