What is the CVSS score of EUVD-2026-39759?

EUVD-2026-39759 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Restaurant Menu are affected by EUVD-2026-39759?

The Restaurant Menu by MotoPress WordPress plugin (versions 2.4.10 and earlier) contains a SQL injection flaw allowing any user with Contributor-level or higher permissions to directly exfiltrate…

How to fix or mitigate EUVD-2026-39759?

Within 24 hours: Audit all WordPress installations for the Restaurant Menu by MotoPress plugin, document installed versions and count users with Contributor+ roles. Within 7 days: Deactivate the plugin or restrict its database query permissions; implement Web Application Firewall rules to block SQL injection patterns in plugin requests. Within 30 days: Monitor Patchstack and MotoPress advisories for patch release; if no patch becomes available within 30 days, plan plugin replacement or implement organizational controls to eliminate Contributor role usage.

Restaurant Menu EUVD-2026-39759

| CVE-2026-57644 HIGH

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-q2fm-j9qm-p92m

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Contributor authentication makes PR:L; network/low-complexity injection yields AV:N/AC:L; SQLi read access gives C:H, with no evidence of write or DoS so I:N/A:N and S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:48 vuln.today

DescriptionCVE.org

Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.

AnalysisAI

SQL injection in the Restaurant Menu by MotoPress WordPress plugin (versions 2.4.10 and earlier) lets users holding Contributor-level accounts inject crafted SQL into backend database queries. Reported by Patchstack and classified as CWE-89, the flaw carries CVSS 8.5 and primarily threatens confidentiality, allowing a low-privileged authenticated user to read arbitrary data from the WordPress database. No public exploit identified at time of analysis, and EPSS/KEV data were not provided in the source intelligence.

Technical ContextAI

Restaurant Menu by MotoPress (slug mp-restaurant-menu) is a WordPress plugin that lets site owners build menus, dishes, and ordering interfaces. The vulnerability is a classic CWE-89 SQL injection: user-controllable input reachable by Contributor-role accounts is concatenated into a SQL statement without adequate parameterization or sanitization, so attacker-supplied syntax is interpreted by the database engine. Because WordPress plugins share the single site database (wp_* tables), a successful injection can reach data well beyond the plugin's own menu records, including user accounts and credential hashes. No CPE strings were provided in the input, so exact affected configuration tuples could not be cross-referenced.

RemediationAI

No exact fixed version was included in the provided data, so update the Restaurant Menu by MotoPress plugin to the latest available release per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mp-restaurant-menu/vulnerability/wordpress-restaurant-menu-by-motopress-plugin-2-4-10-sql-injection-vulnerability?_s_id=cve) - any version above 2.4.10 - and verify the changelog confirms the SQL injection fix before relying on it. Until patched, reduce exposure by tightening role assignments so untrusted authors do not hold Contributor accounts and by disabling open user registration (Settings > General > Membership), accepting that this blocks legitimate self-service signups. A Web Application Firewall with a virtual patch or SQLi ruleset (Patchstack, Wordfence) can block injection payloads against the vulnerable endpoint as a compensating control, with the trade-off of possible false positives on legitimate menu-editing requests.