This vulnerability involves improper neutralization of special elements in SQL commands within the cookforweb All In Menu plugin, enabling blind SQL injection attacks. It affects all versions up to 1.1.5. The CVSS score of 8.5 reflects network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch links are available to confirm remediation status.

Successful exploitation could allow an attacker with low privileges to extract sensitive information from the database due to blind SQL injection. The confidentiality impact is high, while integrity impact is not indicated, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin and monitoring for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted users.