The WPNakama WordPress plugin is vulnerable to a SQL injection flaw in the 'order' parameter of the /wp-json/WPNakama/v1/boards REST API endpoint. Because the plugin fails to escape user input and does not properly prepare the SQL query, an unauthenticated attacker can inject malicious SQL statements that are appended to existing queries. This allows direct extraction of sensitive information from the WordPress database, potentially revealing user data, authentication credentials, and site configuration. The weakness corresponds to CWE-89, which signifies unfiltered input leading to database query manipulation.

This vulnerability affects the WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin developed by qdonow. All releases up to and including version 0.6.5 are impacted; the issue is not present in later releases of the plugin.

The CVSS score of 7.5 indicates a high impact from an exploit perspective, while the EPSS score of less than 1% suggests that, historically, the likelihood of exploitation is low. The flaw is listed as not being part of the CISA KEV catalog. The likely attack vector is through the publicly accessible REST API, which does not require authentication, making any visitor to the site’s domain a potential attacker. If successful, the attacker can read sensitive data from the WordPress database.