The SaveTo Wishlist Lite WordPress plugin, versions earlier than 1.1.5, does not sanitize the 'sort_column' and 'sort_order' parameters that are inserted into an ORDER BY clause of a SQL query. This lack of validation enables unauthenticated attackers to inject arbitrary SQL code, allowing them to retrieve sensitive data such as user credentials, order histories, or other private information stored in the database.

The vulnerability affects the SaveTo Wishlist Lite plugin used on WordPress sites. Any WordPress installation that has the plugin installed and running a version prior to 1.1.5 is susceptible. No specific system hardening or user privilege restrictions are required for the default vulnerability to be exploitable.

Based on the description, it is inferred that the attack vector is a simple HTTP request to a page that accepts 'sort_column' or 'sort_order' query parameters. Because no authentication is required, the attack surface is high. The reported CVSS score of 8.6 reflects a high severity vulnerability that permits unauthenticated database information disclosure. Although the EPSS score is less than 1%, indicating that the exploitation probability is low but not zero, the lack of authentication combined with the ability to extract sensitive data warrants immediate attention. The vulnerability is not listed in CISA’s KEV catalog.