Unauthorized Arbitrary File Creation Vulnerability in WordPress Mega Menu Plugin

CVE-2021-4443

What is CVE-2021-4443?

The WordPress Mega Menu plugin has a security flaw that enables arbitrary file creation through the compiler_save AJAX action in all versions up to 2.0.6. This vulnerability is particularly concerning as it allows attackers who have not authenticated themselves to create PHP files on the server. These files may contain malicious code that can execute unauthorized actions, compromising the integrity and security of the affected WordPress site. Users of the Mega Menu plugin are advised to update to the latest version to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References