Cross-Site Request Forgery Vulnerability in Superfly Responsive Menu Plugin for WordPress

CVE-2024-3238

What is CVE-2024-3238?

The Superfly Responsive Menu plugin for WordPress has a vulnerability that allows for Cross-Site Request Forgery (CSRF). This flaw arises from inadequate nonce validation in the ajax_handle_delete_icons() function, enabling unauthenticated attackers to delete arbitrary files if they can trick a site administrator into executing a crafted action. Although a patch addressing the CSRF issue was released in version 5.0.28, robust directory traversal protections were not implemented until version 5.0.30, leaving exposed versions susceptible to exploitation.

References