{"id":"CVE-2026-92465","published":"2026-09-16T12:17:08.073","lastModified":"2026-09-16T17:53:40.500","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection.\n\nThis issue affects WP Mega Menu: from n/a through 1.4.2.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-megamenu/vulnerability/wordpress-wp-mega-menu-plugin-1-4-2-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This SQL injection vulnerability in WP Mega Menu allows attackers to perform blind SQL injection attacks, potentially leading to unauthorized data access and manipulation. The flaw occurs when user input is not properly sanitized before being used in SQL queries.","exploitability":"Exploitation requires a high-privilege user account (PR:H) and involves crafting malicious input that triggers blind SQL injection, which can be time-consuming but achievable through repeated requests and response analysis.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive data from the WordPress database, potentially including user credentials, configuration settings, and other protected information.","remediation":"Upgrade to WP Mega Menu version 1.4.3 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:56:25.341Z"}}