CVE-2021-24160 - CVE House
Back to Database
Status published High CVE-2021-24160

Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload

Vulnerability Description

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-24160

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Chloe Chamberland

References

More from ExpressTech

View All →
CVE-2024-27966
WordPress Quiz And Survey Master plugin <= 8.2.2 - Cross Site Scripting (XSS) vulnerability
Medium 5.9
CVE-2023-51521
WordPress Quiz And Survey Master plugin <= 8.1.18 - Cross Site Request Forgery (CSRF) vulnerability
Medium 5.4
CVE-2023-51507
WordPress Quiz And Survey Master plugin <= 8.1.16 - Broken Access Control vulnerability
Medium 5.3
CVE-2023-47834
WordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS)
Medium 6.5
CVE-2023-37984
WordPress Quiz And Survey Master plugin <= 8.1.10 - Broken Access Control vulnerability
Medium 4.3

Affected Vendor

ExpressTech

View all reports →

Affected Software

Responsive Menu – Create Mobile-Friendly Menu, Responsive Menu Pro
Vulnerable Versions:
4.0.4

Timeline

Official Publish: April 5th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact