Description (CNA)
The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| quadlayers / QuadMenu – Mega Menu | affected 0 through 2.0.6 |
CWE
CWE-434
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/04003542-fd62-4587-9834-70e7fe8f08ef?source=cve
- https://sh3llcon.org/la-debilidad-de-wordpress/
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wordpress-mega-menu-quadmenu-remote-code-execution-2-0-6/
ADP enrichment
No English description supplied.
No references supplied.