Oncybersec

**Name of the Vulnerable Software and Affected Versions** Multilevel Referral Affiliate Plugin for WooCommerce versions up to 2.27 **Description** The issue allows authenticated attackers with Subscriber-level access and above to inject SQL queries, potentially extracting sensitive information from the database. This is due to insufficient escaping on the `orderby` parameter and lack of preparation on the existing SQL query. **Recommendations** For versions up to 2.27, consider restricting access to the `orderby` parameter in the affected API endpoint until a patch is available. As a temporary workaround, restrict database access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.