CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5.
Explanation of Vulnerability in Simple Terms
The Hero Mega Menu plugin for WordPress contains a SQL injection vulnerability in versions up to 1.16.5. An attacker with low-level WordPress access can craft malicious input to execute arbitrary SQL queries against the site database. This can lead to unauthorized data disclosure and potential site disruption. Update the plugin immediately to a patched version.
What an attacker can do
Read sensitive data from the WordPress database and cause site performance degradation.
Potential impact on your site
Database contents may be exposed; site availability could be affected if queries are resource-intensive.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (subscriber or above).
Key dates
External resources
Related vulnerabilities
