The vulnerability resides in the WP‑ClanWars plugin for WordPress and allows an authenticated user with administrator privileges or higher to inject arbitrary SQL through the 'orderby' parameter. Because the input is insufficiently escaped and the existing query lacks proper preparation, this flaw enables attackers to append additional queries and exfiltrate confidential database information, directly compromising confidentiality and potentially integrity through unauthorized data manipulation. The weakness aligns with CWE‑89, a classic SQL injection.

All installations of the WP‑ClanWars plugin for WordPress up to and including version 2.0.1, provided by andddd, are affected. The flaw exists in the teams.class.php file where the 'orderby' parameter is used in an SQL query.

The CVSS score is 4.9, indicating medium severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The flaw is not listed in the CISA KEV catalog and is only exploitable by users who already possess administrator-level access, limiting its scope to privileged accounts. Because the attack vector requires authenticated access and manual manipulation of the 'orderby' query string, the risk remains moderate but is mitigated by enforcing least privilege and timely patching.