CVE-2021-24348

HIGH

Side Menu - add fixed side buttons < 3.1.5 - Authenticated SQL Injection via did GET Parameter

Title source: llm
STIX 2.1

Description

The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474
Exploit, Patch, Third Party Advisory x_refsource_misc
https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/

Scores

CVSS v3 7.2
EPSS 0.0157
EPSS Percentile 72.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
wow-estore/side_menu < 3.1.5
Published Jun 14, 2021
Tracked Since Feb 18, 2026