Wp Mega Menu
Monthly
Blind SQL injection in Themeum's WP Mega Menu WordPress plugin (versions through 1.4.2) allows an attacker who already holds a high-privilege, administrator-level account to feed crafted input into a vulnerable plugin parameter that is not neutralized before reaching a SQL query, letting them infer database contents one query at a time. Exploitation is privilege-gated (CVSS PR:H) and the injection is blind, so extraction is slow and no anonymous or low-privileged user can reach it; user interaction is not required (UI:N). The CVE carries a CVSS 3.1 base score of 7.6, but the effective risk is lower than that number implies given the authentication prerequisite, and no public exploit code has been identified at time of analysis.
Blind SQL injection in Themeum's WP Mega Menu WordPress plugin (versions through 1.4.2) allows an attacker who already holds a high-privilege, administrator-level account to feed crafted input into a vulnerable plugin parameter that is not neutralized before reaching a SQL query, letting them infer database contents one query at a time. Exploitation is privilege-gated (CVSS PR:H) and the injection is blind, so extraction is slow and no anonymous or low-privileged user can reach it; user interaction is not required (UI:N). The CVE carries a CVSS 3.1 base score of 7.6, but the effective risk is lower than that number implies given the authentication prerequisite, and no public exploit code has been identified at time of analysis.