Admin Notices Manager
Monthly
SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.
SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.