The vulnerability is a SQL Injection flaw that allows an attacker to craft malicious input through the contributor interface of the Restaurant Menu by MotoPress plugin. The flaw leverages unsanitized data, enabling unauthorized execution of arbitrary SQL queries. This could lead to data theft, modification, or deletion, potentially exposing sensitive information stored in the WordPress database. The weakness is identified as CWE-89 and has a CVSS score of 8.5, indicating a high severity of impact.

JetMonsters’ Restaurant Menu by MotoPress plugin versions 2.4.10 and earlier are affected. Users running these versions should verify their plugin version and upgrade accordingly.

The CVSS score of 8.5 reflects a high likelihood of exploitation if the vulnerability is present and the application is reachable via the Internet. Because the EPSS score is not available, the precise likelihood of exploitation is uncertain, but the high CVSS and absence from the CISA KEV catalog do not negate the need for remediation. Attackers can exploit this through standard web requests that target the plugin’s contributor interface, provided the server process can execute SQL against the database.