EUVD-2026-50200
GHSA-hhq3-85v9-3wjh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network vector reflects web-based admin panel access; PR:H confirmed by administrator requirement; confidentiality-only impact matches read-only SQL injection primitive.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL Injection in WP-Lister Lite for eBay (WordPress plugin, all versions ≤ 3.8.8) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL clauses via the unsanitized 'orderby' parameter, enabling exfiltration of sensitive data from the WordPress database. The flaw spans at least three distinct model/table classes - ProfilesModel.php, StocksLogTable.php, and EbayOrdersModel.php - indicating a systemic lack of input preparation rather than an isolated oversight. No public exploit code or CISA KEV listing has been identified at time of analysis; the high privilege requirement substantially constrains the realistic attacker population.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause class. The plugin constructs SQL ORDER BY clauses by directly interpolating user-supplied HTTP parameters without proper escaping or use of WordPress's wpdb prepare() mechanism, which does not natively support positional placeholders for ORDER BY column names. Affected code spans at least six locations across three files: ProfilesModel.php (lines 278, 304), StocksLogTable.php (lines 277, 316), and EbayOrdersModel.php (lines 1291, 1354), all confirmed via the WordPress plugin Trac source browser. The CPE identifier cpe:2.3:a:wp-lab:wp-lister_lite_for_ebay:*:*:*:*:*:*:*:* covers all versions through 3.8.8. Because ORDER BY identifiers cannot be parameterized in standard prepared statements, the fix typically requires an allowlist of permitted column names rather than generic escaping.
RemediationAI
No specific patched version number was provided in the available intelligence data; site owners should consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cec0d64e-7b31-4484-8237-2ab4d730ab86 and the WordPress plugin repository for a release beyond 3.8.8 that addresses this flaw. As a compensating control pending a patch, administrators should restrict access to the WordPress admin panel to trusted IP ranges using server-level rules (e.g., Apache/Nginx IP allowlisting or WAF policy), which reduces the attack surface to the network level despite the existing PR:H requirement. A web application firewall rule targeting SQL metacharacters in the 'orderby' parameter is a secondary option but carries false-positive risk for legitimate sort operations. Disabling or deactivating the WP-Lister Lite for eBay plugin entirely eliminates exposure at the cost of eBay listing management functionality.
More in Wp Lister Lite For Ebay
View allUnauthenticated stored cross-site scripting in the WP-Lister Lite for eBay WordPress plugin affects every release up to
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister L
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today