WordPress - Post Author Authenticated SQLi

Two REST handlers build SQL queries by concatenating client-supplied request parameters straight into the query string. There is no $wpdb->prepare(), no esc_like(), and no whitelisting. The only processing applied is sanitize_text_field(), which trims whitespace and strips tags and control characters. It does not escape quotes and offers no protection against SQL injection.

// includes/api-request/free/multi-authors/class-multiauthors.php — awpa_list_guest_authors()
$orderby     = sanitize_text_field($request['order_by']);   // not an SQL defense
$order       = sanitize_text_field($request['order']);
$search_term = sanitize_text_field($request['search']);
...
$query = "SELECT * FROM $table_name
   WHERE 1=1 AND (user_email LIKE '%$search_term%' OR
   display_name LIKE '%$search_term%' OR ...)
   ORDER BY $orderby $order LIMIT $offset, $authors_per_page;";
$posts = $wpdb->get_results($query, OBJECT);                // no prepare()

Every parameter is an injection point. search breaks out of the LIKE '%...%' string literal order_by and order inject into the identifier/keyword context after ORDER BY.per_page and page inject into the numeric LIMIT clause. The membership-listing handler in class-registered-users.php repeats the same pattern against a different table.

This was reproduced end-to-end against WP Post Author 3.10.0. A boolean oracle and a time-based oracle both fire, and the administrator account's password hash was extracted blind through the endpoint.