// For flags

CVE-2021-24942

Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.

El complemento Menu Item Visibility Control de WordPress hasta la versión 0.5 no sanitiza ni valida la opción "Lógica de visibilidad" para los elementos del menú de WordPress, lo que podría permitir a usuarios altamente privilegiados ejecutar código PHP arbitrario incluso en un entorno reforzado.

The Menu Item Visibility Control plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 0.5 via the 'visibility logic' option. This allows administrator-level attackers to execute code on the server.

*Credits: bl4derunner, WPScan
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-01-14 CVE Reserved
  • 2022-11-29 CVE Published
  • 2024-07-18 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Menu Item Visibility Control Project
Search vendor "Menu Item Visibility Control Project"
 Menu Item Visibility Control
Search vendor "Menu Item Visibility Control Project" for product "Menu Item Visibility Control"
 <= 0.5
Search vendor "Menu Item Visibility Control Project" for product "Menu Item Visibility Control" and version " <= 0.5"
wordpress
Affected