The Paymendo Bank Transfer WordPress plugin version 1.1 contains a flaw in handling the 'orderBy' parameter, which is incorporated directly into a SQL query without proper sanitization. An attacker with valid authentication can inject arbitrary SQL commands, potentially reading, modifying, or deleting data in the plugin’s database tables. Such exploitation could lead to unauthorized data exposure or disruption of the banking transfer functionality, and may serve as a stepping stone to further compromise of the hosting environment if the database grants elevated privileges.

This vulnerability affects installations of the Paymendo Bank Transfer plugin up to and including version 1.1. The vendor is listed as Unknown:paymendo, implying any WordPress site that has deployed this plugin during that period is at risk.

The attack vector requires authentication, so the threat is limited to users who already have access to the WordPress backend or have compromised credentials. The CVSS score of 6.5 and EPSS score of < 1% indicate a moderate severity, but the risk is compounded by the fact that it is not listed in CISA KEV, suggesting no confirmed exploits yet. Nevertheless, the combination of authenticated access and unvalidated input represents a significant risk, especially for sites that allow broader administrative privileges or use the plugin in a production environment.