WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter

Description

The plugin does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the plugin's custom Listing Admin role, and above, to perform SQL injection attacks.