SQL Injection Vulnerability in Themeum WP Mega Menu Plugin
CVE-2026-92465

7.6HIGH

Key Information:

Vendor

WordPress
Status
WP Mega Menu
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92465?

The Themeum WP Mega Menu plugin for WordPress contains a vulnerability that allows for Blind SQL Injection due to improper neutralization of special elements in SQL commands. This flaw can be exploited by attackers to gain unauthorized access to the database, leading to potential data leakage or manipulation. Users are advised to update their WP Mega Menu plugin to version 1.4.2 or later to mitigate this risk.

Affected Version(s)

WP Mega Menu <= 1.4.2

References

https://patchstack.com/database/wordpress/plugin/wp-megam...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal | Patchstack
.