CVE-2014-5183

Simple Retail Menus < 4.1 - Authenticated SQL Injection via targetmenu Parameter

Title source: llm

Description

SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php.

References (2)

Core 2

Core References

Exploit x_refsource_misc

http://codevigilant.com/disclosure/wp-plugin-simple-retail-menus-a1-injection

Exploit, Patch x_refsource_confirm

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=861170%40simple-retail-menus&old=728969%40simple-retail-menus&sfp_email=&sfph_mail=#file1

Scores

EPSS 0.0159

EPSS Percentile 73.1%

Details

CWE

CWE-89

Status published

Products (2)

simple_retail_menus_plugin_project/simple-retail-menus 4.0

simple_retail_menus_plugin_project/simple-retail-menus < 4.0.1

Published Aug 06, 2014

Tracked Since Feb 18, 2026