CVE-2025-23910
Published: 22 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-23910 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89. It affects the Menus Plus+ WordPress plugin, also referred to as keighl Menus Plus+ menus-plus, in all versions from n/a through 1.9.6. The vulnerability was published on 2025-01-22.
With a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), the issue can be exploited over the network by low-privileged authenticated users with low attack complexity and no user interaction required. Exploitation changes scope and enables high confidentiality impact, such as unauthorized data access, alongside low integrity and availability impacts.
Patchstack provides details on the vulnerability in their database for the Menus Plus+ WordPress plugin at https://patchstack.com/database/Wordpress/Plugin/menus-plus/vulnerability/wordpress-menus-plus-plugin-1-9-6-sql-injection-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection vulnerability in public-facing WordPress plugin directly enables network exploitation of the application by authenticated users for data access.