Data disclosure via SQL injection in sorting

SQL injection in admin list screens in WP Lab WP-Lister Lite for eBay before 3.8.9 allows remote authenticated users to read database data via crafted sort parameters. The affected queries accept the orderby and order request parameters in models for orders, profiles, and stock logs and splice them into SQL sorting clauses; the 3.8.9 security fix replaces escaping with a strict allowlist of sortable columns and integer-casts pagination values. Reachability requires the manage_ebay_listings capability, which the vendor states is granted by default to Administrator and Shop Manager, so the published impact is limited to database disclosure rather than direct code execution.