This vulnerability (CVE-2026-57644) is an improper neutralization of special elements used in an SQL command (CWE-89) in the Restaurant Menu by MotoPress plugin. It affects versions up to and including 2.4.10. The flaw allows an attacker with low privileges to perform SQL Injection attacks remotely without user interaction. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, and partial system compromise (confidentiality high, integrity none, availability low). There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to unauthorized SQL command execution, resulting in high confidentiality impact (data disclosure), no integrity impact, and low availability impact (partial denial of service). The attacker requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to SQL injection attempts. Avoid granting unnecessary privileges to users who can interact with the plugin.