The ShopLentor All‑In‑One WooCommerce Growth & Store Enhancement Plugin is vulnerable to a time‑based SQL injection through the 'orderby' parameter. The flaw stems from insufficient input escaping and the absence of prepared statements, allowing an attacker who can authenticate as an administrator or higher to append malicious SQL code to existing queries. By manipulating the parameter, the attacker may retrieve sensitive data from the database. This weakness is classified as CWE‑89, a classic example of unsafe SQL construction.

Any WordPress installation running ShopLentor plugin version 3.4.5 or earlier is affected. The vulnerability is not limited to a specific site module but applies to the plugin’s handling of the 'orderby' query string in its database queries.

The CVSS base score of 4.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Because the attack requires authentication with administrator privileges, the risk is confined to environments where admin credentials are compromised or weak. The flaw is not listed in the CISA KEV catalog, implying limited known exploitation. An adversary would need to log into the WordPress admin interface, manipulate the 'orderby' parameter, and observe timing or error responses to validate injection before attempting data extraction.