Hero Mega Menu WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Hero Mega Menu - Responsive WordPress Menu Plugin, affecting all versions through 1.16.5. The issue arises from inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. This vulnerability allows authenticated attackers with Subscriber-level access and above to inject additional SQL queries into existing ones, potentially leading to the extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling authenticated attackers to manipulate SQL queries and access sensitive database information.