PT-2022-9519 · WordPress · Menu Item Visibility Control

Anton Sarsadskikh + 1 · Published 2022-12-26 · Updated 2023-06-30 · CVE-2021-24942

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Menu Item Visibility Control WordPress plugin versions 0.5 and earlier

Description The issue concerns the Menu Item Visibility Control WordPress plugin, which fails to properly sanitize and validate the Visibility logic option for WordPress menu items. This could potentially allow highly privileged users to execute arbitrary PHP code, even in environments with heightened security measures.

Recommendations For Menu Item Visibility Control WordPress plugin versions 0.5 and earlier, consider disabling the Visibility logic option until a patch is available to prevent potential exploitation. Restrict access to this feature to minimize the risk of arbitrary PHP code execution.

Exploit

Fix

Related Identifiers

CVE-2021-24942

Affected Products

Menu Item Visibility Control

References · 4

• 🔥 https://wpscan.com/vulnerability/eaa28832-74c1-4cd5-9b0f-02338e23b418 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24942 · Security Note
• https://t.me/cibsecurity/55358 · Telegram Post