PT-2025-1729 · WordPress · Wp Menu Image

Published 2025-01-07 · Updated 2025-01-17 · CVE-2024-12022

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Menu Image plugin for WordPress versions up to, and including, 2.2

Description The issue is related to a missing capability check on the wmi delete img menu function, which allows unauthenticated attackers to delete images from menus. This makes it possible for unauthorized modification of data.

Recommendations For versions up to, and including, 2.2, consider disabling the wmi delete img menu function until a patch is available to prevent unauthorized deletion of images from menus. Update to a version that includes a fix for this issue, as the current version has a missing capability check that poses a security risk.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-12022

Affected Products

Wp Menu Image

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-12022 · Security Note
• https://t.me/cvenotify/106492 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e96193c0-ddde-463b-a68e-672ab6f812c7?source=cve · Note
• https://t.me/cvedetector/14443 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-menu-image/trunk/init/wmi-functions.php#L126 · Note
• https://twitter.com/CVEnew/status/1876476550641582494 · Twitter Post