Now officially on WordPress.org

CVE Database / CVE-2022-25602

CVE · High

CVE-2022-25602 — Responsive Menu – Create Mobile-Friendly Menu [responsive-menu] < 4.1.8

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-25602 Responsive Menu – Create Mobile-Friendly Menu [responsive-menu] < 4.1.8 Exposure of Sensitive Information to an Unauthorized Actor High 8.8 < 4.1.8 4.1.8 2022-03-16 —

CVE-2022-25602

The Responsive Menu plugin before version 4.1.8 fails to properly authorize several AJAX functions including save_menu_global_settings, instead depending solely on CSRF nonces that are accessible to all authenticated users. This vulnerability enables any logged-in user to execute these protected actions without proper permission checks, potentially resulting in unauthorized file uploads, deletion of themes, and modification of plugin configuration settings.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings