This vulnerability (CVE-2025-7014) involves session fixation (CWE-384) in the QR Menu Pro Smart Menu Systems Menu Panel. An attacker can exploit this flaw to fixate a user's session ID, potentially allowing session hijacking. The affected product versions include Menu Panel through 29012026. The vendor has not responded to disclosure attempts and no patch or fix has been published. The CVSS 3.1 base score is 5.7, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacting confidentiality but not integrity or availability.

Successful exploitation of this vulnerability can lead to session hijacking, allowing an attacker to impersonate a legitimate user and access sensitive information. The impact is limited to confidentiality compromise without affecting integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor for updates from the vendor. Until a patch is available, consider implementing additional session management controls such as regenerating session IDs after authentication and enforcing strict session expiration policies to reduce risk.