Vulnerability · Published Apr 5, 2021 · Assigned by WPScan
CVE-2021-24160Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload
High 8.8
In plain English
A high-severity unrestricted file upload in Responsive Menu – Create Mobile-Friendly Menu from ExpressTech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.2% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ExpressTech | Responsive Menu – Create Mobile-Friendly Menu | 4.0.4 – before 4.0.4 |
| ExpressTech | Responsive Menu Pro | 4.0.4 – before 4.0.4 |
Weakness: CWE-434