CVE-2021-24161CWE-352

Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload

published April 5, 2021

CVSS
—
EPSS
1%
Percentile
69.2
In the wild
Unconfirmed
What it is

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01249 · 69.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-04-05T18:27Z
EPSS history
Timeline
  • 05 APR 18:27Z
    Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload
    cvelistv5