SQL Injection in WP Lab WP-Lister Lite for eBay can expose database data

Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.

• WP Lab WP-Lister Lite for eBay: versions <= 3.8.11 are identified as affected.
• Patched release: version 3.8.12 is identified by Patchstack and the supplied record as unaffected.
• Solution guidance: the supplied solution recommends updating to the latest available version, at least 3.8.12.
• The available evidence does not establish the status of parallel release branches or versions outside the stated boundaries.

WP Lab WP-Lister Lite for eBay contains a SQL Injection flaw in functionality or processing used by the Shop manager role. User-controlled data is not properly neutralized before it is incorporated into an SQL command, allowing the query to be influenced outside the application's intended behavior. The record identifies network reachability, requires Shop manager privileges, does not require user interaction, and has low attack complexity. Public details do not identify the endpoint, parameter, function, or payload involved, so the exact implementation and triggering conditions remain unknown.

The flaw is reachable over the network by an account with Shop manager privileges; the record rates the required privileges as high, requires no interaction from another user, and has low complexity. The record does not identify known exploitation and marks public exploit as false. Patchstack describes the issue as unlikely to be exploited, but that does not remove the risk for sites where Shop manager access is broadly assigned. No campaign, victim, payload, or specific exploit is identified in the available evidence.

The flaw allows input handled by a user with Shop manager privileges to influence an SQL command in the plugin. The record describes high confidentiality impact, no integrity impact, and low availability impact, with changed security scope. Realistic consequences include disclosure of database contents, private information, or account-related data. Because high privileges are required, the available evidence does not support treating this as an unauthenticated attack path, and it does not establish WordPress administrator access or data modification.

• Data confidentiality: SQL injection may allow a malicious actor to interact directly with the database and disclose information, including private data or account-related data.
• Access scope: Exploitation requires Shop manager privileges, so exposure is concentrated in sites that issue this role to users or integrations.
• Service impact: The record assesses availability impact as low, so limited disruption is possible under some conditions.
• Limits: The evidence does not confirm data modification, an attack campaign, or a specific compromise.

1. Update the plugin: upgrade WP-Lister Lite for eBay to the latest available version, at least 3.8.12.
2. Verify after deployment that the wp-lister-for-ebay package is running the patched release on every WordPress site, including sites managed through separate deployment or update processes.
3. While patching is pending, review and reduce Shop manager access to the accounts that require it. This is temporary exposure reduction and does not replace the patch.
4. If the update cannot be completed directly, Patchstack recommends contacting the hosting provider or web developer for assistance. No specific technical workaround is confirmed by the public evidence.

1. Inventory WordPress sites where the wp-lister-for-ebay package is installed or active.
2. Identify accounts with the Shop manager role and verify whether that access is broader than operationally required.
3. Compare the deployed plugin release with the affected and patched boundaries in affected_summary.
4. Review authentication logs, application logs, database logs, and WAF telemetry for unusual queries associated with Shop manager sessions. Treat this as precautionary monitoring, not as a source-confirmed indicator.
5. Do not treat the absence of suspicious log entries as proof of safety, because the public evidence does not provide a specific indicator set or log signature for this flaw.