Vulnerability · Published Apr 5, 2021 · Assigned by WPScan
CVE-2021-24161Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload
High 8.8
In plain English
A high-severity cross-site request forgery in Responsive Menu – Create Mobile-Friendly Menu from ExpressTech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.2%top 30.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ExpressTech | Responsive Menu – Create Mobile-Friendly Menu | 4.0.4 – before 4.0.4 |
| ExpressTech | Responsive Menu Pro | 4.0.4 – before 4.0.4 |
Weakness: CWE-352