PT-2021-16043 · WordPress · The Side Menu Lite

Pang0Lin · Published 2021-08-09 · Updated 2021-08-17 · CVE-2021-24521

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Side Menu Lite – add sticky fixed buttons WordPress plugin versions prior to 2.2.1

Description The issue concerns the improper sanitization of input values from the browser when building an SQL statement, potentially allowing an SQL Injection attack. Users with the administrator role or permission to manage this plugin could exploit this.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's management interface to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24521

Affected Products

The Side Menu Lite

References · 5

• 🔥 https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md · Exploit
• 🔥 https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd · Exploit
• https://osv.dev/vulnerability/CVE-2021-24521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24521 · Security Note
• https://t.me/cvenotify/18902 · Telegram Post