PT-2024-11039 · WordPress · Wordpress Mega Menu

Mikel Gorraiz + 1 · Published 2024-10-15 · Updated 2024-10-21 · CVE-2021-4443

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Mega Menu plugin versions up to, and including, 2.0.6

Description The WordPress Mega Menu plugin is vulnerable to Arbitrary File Creation, allowing unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code via the compiler save AJAX action. This vulnerability enables remote code execution. Users are urged to update to the latest version immediately to mitigate risks.

Recommendations For WordPress Mega Menu plugin versions up to, and including, 2.0.6, update to the latest version immediately to resolve the issue. As a temporary workaround, consider disabling the compiler save AJAX action until a patch is available. Restrict access to the vulnerable plugin to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-4443

Affected Products

Wordpress Mega Menu

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-4443 · Security Note
• https://sh3llcon.org/la-debilidad-de-wordpress · Note
• https://twitter.com/CveFindCom/status/1846446757812564132 · Twitter Post
• https://twitter.com/transilienceai/status/1847688507151540457 · Twitter Post
• https://twitter.com/cracbot/status/1848242888783933546 · Twitter Post
• https://twitter.com/transilienceai/status/1847688500994318379 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/04003542-fd62-4587-9834-70e7fe8f08ef?source=cve · Note
• https://acunetix.com/vulnerabilities/web/wordpress-plugin-wordpress-mega-menu-quadmenu-remote-code-execution-2-0-6 · Note
• https://twitter.com/CVEnew/status/1846444843318272161 · Twitter Post