PT-2024-26786 · WordPress · Ubermenu

Mohamed Awad + 1 · Published 2024-06-21 · Updated 2024-08-20 · CVE-2024-3593

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions UberMenu plugin for WordPress versions up to, and including, 3.8.3

Description The issue is due to missing or incorrect nonce validation on the ubermenu delete all item settings and ubermenu reset settings functions. This allows unauthenticated attackers to delete and reset the plugin's settings via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

Recommendations For UberMenu plugin for WordPress versions up to, and including, 3.8.3, update to a version later than 3.8.3 to resolve the issue. As a temporary workaround, consider disabling the ubermenu delete all item settings and ubermenu reset settings functions until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-3593

Affected Products

Ubermenu

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-3593 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3593 · Vendor Advisory
• https://twitter.com/CVEnew/status/1804391638040527211 · Twitter Post
• https://t.me/cvenotify/84110 · Telegram Post
• https://t.me/cvenotify/91420 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/621ef583-bf99-4b81-ae9c-b4f1c86b86aa?source=cve · Note
• https://codecanyon.net/item/ubermenu-wordpress-mega-menu-plugin/154703 · Note