CVE-2024-3476 Side Menu Lite < 4.2.1 - Menu Deletion via CSRF

2024-05-0206:00:03

WPScan

github.com

wordpress

csrf

side menu lite

security

plugin

AI Score

6.8

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Side Menu Lite ",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:wow-company:side_menu_lite:*:*:*:*:*:*:*:*"
    ],
    "vendor": "wow-company",
    "product": "side_menu_lite",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]