An SQL injection flaw exists in the Shop Manager component of WP‑Lister Lite for eBay for all versions 3.8.11 and earlier. The vulnerability allows an unauthenticated or low‑privilege user to inject arbitrary SQL statements through the plugin’s input mechanisms, potentially enabling reading, modification, or deletion of database records. The weakness is identified as CWE‑89, a classic vulnerability where unsanitized input is used to build database queries.

The issue affects WordPress sites that have the WP‑Lister Lite for eBay plugin installed at version 3.8.11 or older. The plugin is provided by WP Lab. Administrators should verify the current plugin version and determine whether a newer release is in use.

The vulnerability carries a CVSS score of 7.6, indicating a high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the plugin’s exposed web interface, where an attacker could submit crafted input to influence SQL queries. Exploitation requires no special access beyond the ability to interact with the site’s front‑end, making the risk significant for publicly accessible WordPress installations.