CVE-2021-4443

CRITICAL

WordPress Mega Menu <= 2.0.6 - Arbitrary File Creation

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-4443 has a selected CVSS score of 9.8 (critical).

Description

The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 15, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 16, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

WordPress Mega Menu plugin for WordPress

Browse QuadLayers / WordPress Mega Menu plugin for WordPress
VulnCheckVersion data not supplied

QuadMenu – Mega Menu

Browse quadlayers / QuadMenu – Mega Menu

Default status: unaffected

CVE ListThrough 2.0.6affected

wordpress_mega_menu-quadmenu

Browse quadlayers / wordpress_mega_menu-quadmenu

Default status: unknown

CVE ListThrough 2.0.6affected

References

4