## Summary
WP Mega Menu contains a CWE-89 SQL Injection that enables blind SQL injection. The issue affects WP Mega Menu versions from n/a through 1.4.2, and Patchstack recommends updating the affected plugin immediately.
## Technical Details
- Vulnerability type: SQL Injection (improper neutralization of special elements used in an SQL command).
- Impact mechanism: a malicious actor can craft inputs that cause the plugin to execute unintended database queries, enabling blind SQL injection.
- Potential outcome stated by Patchstack: an attacker may be able to directly interact with the database, including stealing information.
- Exploit prerequisites (from provided content): Patchstack indicates exploitation is unlikely/low severity impact in their write-up, but the CVSS vector shows network reachability (AV:N) and requires privileges (PR:H).
## Affected
- Themeum WP Mega Menu versions: n/a through 1.4.2.
## Impact
- Confidentiality: C:H (high) per the provided CVSS.
- Availability: A:L (low) per the provided CVSS.
- Patchstack notes the issue has a low severity impact and is unlikely to be exploited, but the described SQL injection can still enable database interaction and potential information theft.
## Mitigation
1. Update WP Mega Menu to a patched version (Patchstack: “As immediate action, update the affected plugin.”).
2. If you cannot update, contact your hosting provider or web developer for assistance.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CWE-89