The myLinksDump WordPress plugin contains a classic SQL injection flaw in the 'sort_by' and 'sort_order' request parameters. Input supplied by an authenticated administrator is inserted directly into a SQL query without escaping or proper preparation, allowing an attacker to append arbitrary SQL statements. This flaw enables the retrieval of confidential database information, thereby compromising data confidentiality and potentially data integrity if destructive queries were executed.

All releases of the myLinksDump plugin distributed by Silvercover up to and including version 1.6 are affected. WordPress sites that run a vulnerable version of this plugin and allow administrators to use its sort functionality are at risk.

The vulnerability has a CVSS score of 7.2, indicating a medium to high severity. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker be authenticated with administrator or higher privileges, so the attack vector is inferred to be through the authenticated use of the plugin’s sorting controls.