High severity · published Apr 5, 2021
CVE-2021-24160
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the…
8.8
CVSS
8.2%
EPSS
No
On KEV
Description
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.2% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
Responsive Menu · Expresstech
before 4.0.4; before 4.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24160
Exploit
https://wpscan.com/vulnerability/066ba5d4-4aaa-4462-b106-500c1f291c37
Exploit
https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/
More from Responsive Menu
8.8
CVE-2022-25602
Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7)
8.8
CVE-2021-24162
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings
8.8
CVE-2021-24161
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious…
8.8
CVE-2017-18513
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface