Fast Courier WordPress plugin versions 5.0.0 through 5.2.3 fail to sanitize and escape the wp_order_id parameter used in an unauthenticated REST route, enabling attackers to inject SQL statements. This flaw, classified as a SQL injection (CWE‑89), allows any unauthenticated visitor to read arbitrary database contents, potentially exposing sensitive user data and compromising confidentiality.

The vulnerability affects the Fast Courier WordPress plugin from version 5.0.0 to 5.2.3 inclusive. Users operating any of these versions are susceptible unless the plugin is updated to 5.2.4 or later.

Although the EPSS score is below 1% and the vulnerability is not in the CISA KEV list, the attack path remains straightforward: an unauthenticated HTTP request to the REST endpoint can be crafted to inject malicious SQL. The absence of authentication requirements lowers the bar for exploitation, and the potential for data exfiltration makes the risk significant for exposed applications.