CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.
Explanation of Vulnerability in Simple Terms
The Hero Mega Menu plugin for WordPress contains a SQL injection vulnerability in versions up to 1.16.5. An attacker with low-level WordPress access can craft malicious input to execute arbitrary SQL queries against the site database. This can expose sensitive data including user credentials and site configuration. The vulnerability affects the scope beyond the plugin itself.
What an attacker can do
Read or modify data in the WordPress database, including user accounts and sensitive site information.
Potential impact on your site
User data, passwords, and site configuration could be exposed or altered by an authenticated attacker.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (subscriber or above).
Key dates
External resources
Related vulnerabilities
