Atomic Edge analysis of CVE-2026-57644:
This vulnerability allows authenticated attackers with contributor-level access or higher to perform SQL injection attacks through the Restaurant Menu and Food Ordering plugin for WordPress. The flaw exists in the customer data handling functions within the class-customer.php file, affecting versions up to and including 2.4.10. The CVSS score of 6.5 indicates a high severity issue.
Root Cause:
The root cause is insufficient input sanitization and parameterized query preparation in the mp-restaurant-menu/classes/models/shop/class-customer.php file. Multiple functions directly interpolate user-supplied values into SQL queries without proper escaping or validation. Specifically, the get_by() method at line 54 uses the $params[“field”] parameter directly in the WHERE clause without sanitization. The get_columns() method at line 166 does not sanitize the $args[‘fields’] array elements before concatenation. The search functionality at lines 174-176 concatenates $args[‘search_by’] and $args[‘search_value’] directly into the query string. The check_for_existing_email() method at line 283 constructs a query with direct string interpolation of the $customer_email parameter using double quotes.
Exploitation:
An attacker with contributor-level access can craft HTTP requests targeting the vulnerable methods. The primary attack vector involves the customer retrieval endpoints that accept a “field” parameter to specify which column to query. By injecting SQL syntax into the field parameter, such as “id UNION SELECT user_login,user_pass FROM wp_users”, an attacker can extract sensitive data from other database tables. The attacker can also manipulate the search functionality by injecting SQL into the search_by parameter to bypass intended query limitations. Direct requests to the plugin’s AJAX handlers or admin-ajax.php with crafted parameters can trigger the vulnerable code paths.
Patch Analysis:
The patch introduces two new helper methods: sanitize_column() and sanitize_sql_columns(). The sanitize_column() method validates input against a whitelist of allowed column names: id, user_id, email, name, telephone, purchase_value, purchase_count, payment_ids, notes, date_created. Any column name not in this list returns an empty string, effectively blocking SQL injection through the field parameter. The sanitize_sql_columns() method applies sanitize_column() to each element of the fields array and filters out invalid entries. The patch also adds proper prepare() statements for the search_value parameter in the WHERE clause construction and implements absint() for numeric parameters like number and offset. The orderby parameter is now sanitized through sanitize_column(), and the order parameter is validated against ASC/DESC values. Additionally, the check_for_existing_email() method now uses $wpdb->prepare() with a %s placeholder instead of direct string interpolation.
Impact:
Successful exploitation allows attackers to extract sensitive data from the WordPress database beyond what the plugin intends to expose. This includes user credentials (hashed passwords), session tokens, user meta data, and potentially other sensitive configuration information stored in the database. The attack requires authentication but only at the contributor level, which is a relatively low-privilege role. An attacker could potentially obtain administrator credentials and escalate privileges to full site control, leading to complete compromise of the WordPress installation.
