Vulnerabilities > CVE-2024-2508
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
LOW Availability impact
NONE network
low complexity
Summary
The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the '_mobmenu_icon' post meta to arbitrary posts with an arbitrary (but sanitized) value. NOTE: Version 2.8.4.4 contains a partial fix for this vulnerability.
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd9569f-3cda-4482-8ccd-c3f362b4e651?source=cve
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fmobile-menu%2Ftrunk%2Fincludes%2Fclass-wp-mobile-menu-core.php&old=3125561&new_path=%2Fmobile-menu%2Ftrunk%2Fincludes%2Fclass-wp-mobile-menu-core.php&new=3125561&sfp_email=&sfph_mail=