CVE-2014-5183 Simple Retail Menus <= 4.0.1 - SQL Injection
MediumCVSS 6.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress simple-retail-menus(WordPress) | < 4.1 | 4.1 |
| simple retail menus plugin project simple-retail-menus | <= 4.0.1 | No fix listed |
| simple retail menus plugin project simple-retail-menus | = 4.0 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- codevigilant.com exploit
- plugins.trac.wordpress.org exploit patch