Oh. And it's for wordpress. Isn't that just fucking wonderful. I would guess looking at the age of the account and the complete lack of documentation that it's a personal project he never really intended to get much scrutiny. I'm sure if someone looked at my github they could find some bad code too. Not that bad though.

Edit - made an issue.

And it has been already exploited: http://wordpress.org/support/topic/plugin-ezpz-one-click-bac...

The difference is that SQL injection will only happen when using raw queries.

System (as you mentioned) or EXEC injections, however, may get out of hand.

I only found one exploitable example browsing the first few pages, whereas the majority of the OP's results looked fairly exploitable.