The SaveTo Wishlist Lite WordPress plugin, versions earlier than 1.1.5, does not sanitize the 'sort_column' and 'sort_order' parameters that are inserted into an ORDER BY clause of a SQL query. This lack of validation enables unauthenticated attackers to inject arbitrary SQL code, allowing them to retrieve sensitive data such as user credentials, order histories, or other private information stored in the database.

The vulnerability affects the SaveTo Wishlist Lite plugin used on WordPress sites. Any WordPress installation that has the plugin installed and running a version prior to 1.1.5 is susceptible. No specific system hardening or user privilege restrictions are required for the default vulnerability to be exploitable.

The vehicle for exploitation is a simple HTTP request to a page that accepts 'sort_column' or 'sort_order' query parameters. Because no authentication is required, the attack surface is high. Although no CVSS score is listed, the potential for complete data exfiltration places the severity in the high to critical range. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, but the unauthenticated nature of the flaw warrants immediate attention.