EUVD-2026-80675
GHSA-7x9r-4mwg-89hw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
DeliverySubmit crafted input to vulnerable plugin parameter
-
ExploitInjected SQL executes in database query
-
ExecutionBlind boolean/time-based inference
-
ImpactExfiltrate sensitive database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with high privileges (CVSS PR:H, effectively administrator-level) on a site running Themeum WP Mega Menu version ≤1.4.2; the attacker then supplies malicious input to a vulnerable plugin parameter that reaches an unsanitized SQL query. The primary limiting factors are the PR:H authentication requirement (no anonymous exploitation) and the blind nature of the injection, which forces slow inference-based extraction rather than direct data dumps. No user interaction is needed (UI:N). No fixed version is confirmed in the provided data - upgrading beyond 1.4.2 when a patched release is published, and restricting high-privilege accounts, are the mitigations. |
| Impact | This is a genuine but privilege-gated issue that scores lower in real-world risk than its 7.6 CVSS implies. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L is network-reachable and low-complexity, but the critical limiter is PR:H - exploitation requires an already-authenticated high-privilege (effectively administrator-level) WordPress user, which sharply narrows the realistic threat model to malicious insiders, compromised admin accounts, or multi-admin/multi-tenant sites. The elevated 7.6 is driven largely by the S:C (scope change) assignment; without that, a PR:H blind read-only SQLi would score meaningfully lower, and I consider S:C debatable for an in-application SQL query (see assessed vector). Blind SQL injection (CWE-89) means data is inferred boolean/time-based rather than dumped directly, so exploitation is slower and typically automated with tooling like sqlmap. No EPSS score, no CISA KEV entry, and no public exploit are present in the input: exploitation status is no public exploit identified at time of analysis. There is no SSVC decision data provided. Net: a real vulnerability worth patching on multi-user WordPress installs, but not an emergency for single-admin sites given the PR:H barrier. |
| Exploit ScenarioDerived | An authenticated high-privilege user on a WordPress site running WP Mega Menu ≤1.4.2 submits crafted input to a vulnerable plugin parameter, injecting SQL that the plugin passes unsanitized into a database query. Because the flaw is blind, the attacker uses boolean/time-based inference (e.g., via sqlmap) to extract sensitive database contents such as user hashes, secrets, or other site data. No public proof-of-concept is available in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Blind SQL injection in Themeum's WP Mega Menu WordPress plugin (versions through 1.4.2) allows an attacker who already holds a high-privilege, administrator-level account to feed crafted input into a vulnerable plugin parameter that is not neutralized before reaching a SQL query, letting them infer database contents one query at a time. Exploitation is privilege-gated (CVSS PR:H) and the injection is blind, so extraction is slow and no anonymous or low-privileged user can reach it; user interaction is not required (UI:N). The CVE carries a CVSS 3.1 base score of 7.6, but the effective risk is lower than that number implies given the authentication prerequisite, and no public exploit code has been identified at time of analysis.
RemediationAI
No vendor-released patch is identified in the available data; the advisory reference (https://patchstack.com/database/wordpress/plugin/wp-megamenu/vulnerability/wordpress-wp-mega-menu-plugin-1-4-2-sql-injection-vulnerability?_s_id=cve) should be monitored for a fixed release, and once a version above 1.4.2 is published the plugin should be upgraded to it immediately. Until then, the most effective compensating control is to reduce the population of high-privilege accounts, since the flaw requires an administrator-level WordPress user: audit Administrator-role users, remove or demote stale accounts, enforce unique credentials and strong authentication for the remaining admins, and treat any administrator account as a SQL-injection-capable foothold. If the plugin's menu functionality is not actively used, deactivate and delete it, which removes the attack surface entirely at the cost of losing the navigation feature; if it must stay enabled, a web application firewall or reverse-proxy rule set tuned to block SQL metacharacters and union/boolean patterns on requests to the plugin is a partial mitigation, though it can be bypassed with encoding tricks and may generate false positives on legitimate menu administration traffic. Because the injection is blind, detection depends on anomalous administrator request patterns and database error or timing telemetry rather than obvious payloads, so logging and alerting on privileged plugin parameter activity is worthwhile alongside the access restrictions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-89, Improper Neutralization of Special Elements used in an SQL Command, in the Themeum WP Mega Menu plugin for WordPress. A plugin parameter is passed into a SQL statement without proper sanitization, parameterization, or escaping, so injected SQL syntax is interpreted by the underlying MySQL/MariaDB database rather than treated as data. Because the flaw is blind, the attacker cannot read query output directly and must instead reconstruct data through boolean or time-based inference using the application's differential responses, which makes bulk exfiltration impractical but still permits targeted disclosure of sensitive records. The plugin is distributed through the WordPress ecosystem as a third-party extension, and the CPE cpe:2.3:a:themeum:wp_mega_menu:*:*:*:*:*:*:*:* tracks the plugin generically while the EUVD record (EUVD-2026-80675) and the description both bound the affected range at n/a through 1.4.2. The CVSS vector supplied upstream (PR:H, S:C, C:H, I:N, A:L) and the independent assessment (PR:H, S:U, C:H, I:N, A:N) agree on the core facts: remote network reachability, no user interaction, high confidentiality only, and high privileges required.
Know when Wp Mega Menu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
PR:H because exploitation needs an admin-level account; blind SQLi yields read-only data disclosure so C:H, I:N, A:N; scope kept S:U as the query stays within the application's DB authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection.
This issue affects WP Mega Menu: from n/a through 1.4.2.
Executive ViewAI
The Themeum WP Mega Menu WordPress plugin, versions through 1.4.2, contains an authenticated blind SQL injection that could allow a high-privilege administrator-level user to slowly infer database contents. Because exploitation requires an existing administrator account, the immediate organizational risk is concentrated in environments with weak privileged-access controls or compromised admin credentials; no public exploit identified at time of analysis. No vendor-released patch identified at time of analysis, so affected WordPress sites remain dependent on compensating controls and enhanced monitoring.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing WP Mega Menu versions through 1.4.2 if not essential, restricting administrator-level access and enforcing least privilege, applying WAF or virtual patching rules, monitoring plugin and database activity, and rotating privileged credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB