Vulnerability Details CVE-2014-5183
SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 54.4%
CVSS Severity
CVSS v2 Score 6.5
References
- http://codevigilant.com/disclosure/wp-plugin-simple-retail-menus-a1-injection
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=861170%40simple-retail-menus&old=728969%40simple-retail-menus&sfp_email=&sfph_mail=#file1
- http://codevigilant.com/disclosure/wp-plugin-simple-retail-menus-a1-injection
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=861170%40simple-retail-menus&old=728969%40simple-retail-menus&sfp_email=&sfph_mail=#file1
Products affected by CVE-2014-5183
-
cpe:2.3:a:simple_retail_menus_plugin_project:simple-retail-menus:4.0
-
cpe:2.3:a:simple_retail_menus_plugin_project:simple-retail-menus:4.0.1