Unauthorized Arbitrary File Creation Vulnerability in WordPress Mega Menu Plugin
CVE-2021-4443

9.8CRITICAL

Key Information:

Vendor

Wordpress
Status
WordPress Mega Menu – Quadmenu
Vendor
CVE Published:
16 October 2024

What is CVE-2021-4443?

The WordPress Mega Menu plugin has a security flaw that enables arbitrary file creation through the compiler_save AJAX action in all versions up to 2.0.6. This vulnerability is particularly concerning as it allows attackers who have not authenticated themselves to create PHP files on the server. These files may contain malicious code that can execute unauthorized actions, compromising the integrity and security of the affected WordPress site. Users of the Mega Menu plugin are advised to update to the latest version to mitigate this risk.

Affected Version(s)

WordPress Mega Menu – QuadMenu * <= 2.0.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://sh3llcon.org/la-debilidad-de-wordpress/
https://www.acunetix.com/vulnerabilities/web/wordpress-pl...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

MikelGorraiz
.