Description

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.

Related CPE's

a

expresstech

responsive_menu

2

References

https://wpscan.com/vulnerability/066ba5d4-4aaa-4462-b106-500c1f291c37

ExploitThird Party Advisory

https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/

ExploitThird Party Advisory

Weaknesses

[email protected]

Primary
CWE-434

[email protected]

Secondary
CWE-434

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-04-05T19:15:15.107

4 years ago

Last modified

2021-04-08T19:25:41.600

4 years ago