CVE-2021-24160CWE-434

Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload

published April 5, 2021

CVSS
—
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08196 · 94.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2021-04-05T18:27Z
EPSS history
Timeline
  • 05 APR 18:27Z
    Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload
    cvelistv5