Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection
Priority LOW 35CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
Why it matters now
EPSS 0.01565 75th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Side Menu – add fixed side buttons (Unknown): 3.1.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Side Menu – add fixed side buttons | 3.1.5 to before 3.1.5 | 3.1.5 | Patch available | CNA |
- Side Menu – add fixed side buttons VendorUnknown Affected 3.1.5 to before 3.1.5 Fixed in 3.1.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wow-estore:side_menu:*:*:*:*:*:wordpress:*:* | before 3.1.5 | Vulnerable | Wow-estore |
- cpe:2.3:a:wow-estore:side_menu:*:*:*:*:*:wordpress:*:* Versions before 3.1.5 Vulnerable ·Wow-estore
Remediation
- Fix · CNA Side Menu – add fixed side buttons (Unknown) Fixed in 3.1.5
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24348
- 2026-10-03 Alias added: GHSA-3545-vxgq-p67f
References
More Wow-estore Side Menu vulnerabilities
- TI-2021-06864 Side Menu Lite < 2.2.6 - Authenticated SQL Injection CVSS 3.1HIGH 8.8
- TI-2021-06808 Side Menu Lite < 2.2.1 - Authenticated SQL Injection CVSS 3.1HIGH 7.2
Sources
- CVE-2021-24348 · CVE Program
- CVE-2021-24348 · NVD
- FIRST EPSS
- GHSA-3545-vxgq-p67f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences