Vulnerability in Menu Item Visibility Control Project
CVE-2021-24942
The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.
EPSS: 0.012 (65.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Menu_item_visibility_control_project Menu_item_visibility_control
- Unknown Menu Item Visibility Control — versions 0
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2021-24942?
- CVE-2021-24942 is a high-severity vulnerability in Menu Item Visibility Control Project, classified under CWE-94 IMPROPER CONTROL OF GENERATION OF CODE ('CODE INJECTION'). CVSS score: 7.2/10. Published 2022-12-26.
- How severe is CVE-2021-24942?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2021-24942 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.