CVE-2024-12773

CVE-2024-12773 is a SQL injection vulnerability (CWE-89) in the Altra Side Menu WordPress plugin through version 2.0. The flaw arises because the plugin does not sanitize and escape a parameter before incorporating it into a SQL statement, enabling unauthenticated SQL injection attacks when exploited by authorized users.

The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity and no user interaction required, but necessitates high privileges such as administrator access. An attacker with admin rights can inject malicious SQL payloads to achieve high-impact confidentiality, integrity, and availability compromises, potentially leading to full database compromise, data exfiltration, modification, or deletion.

For mitigation details, refer to the WPScan advisory at https://wpscan.com/vulnerability/fab64105-599f-49a4-b01d-c873ff34b590/.