CVE-2024-3238 – WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion

https://notcve.org/view.php?id=CVE-2024-3238

01 Aug 2024 — The WordPress Menu Plugin — Superfly Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.29. This is due to missing or incorrect nonce validation on the ajax_handle_delete_icons() function. This makes it possible for unauthenticated attackers to delete arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please not the CSRF was patched in 5.0.28, however, a... • https://codecanyon.net/item/superfly-responsive-wordpress-menu-plugin/8012790 • CWE-352: Cross-Site Request Forgery (CSRF) •