Serious WordPress plugin security flaw puts thousands of sites at risk of attack

WordPress on a laptop
(Image credit: Shutterstock)

Wordfence has discovered three vulnerabilities in the popular WordPress plugin Responsive Menu that could have exposed over 100,000 sites to takeover attacks.

Of these vulnerabilities, one is tracked as critical with a CVSS score of 9.9, another is tracked as high with a score of 8.8 and the third vulnerability is tracked as medium with a score of 5.4.

The first flaw makes it possible for an authenticated attacker with low-level permissions to upload arbitrary files to achieve remote code execution while the other two flaws allow an attacker to forge requests to modify the plugin's settings and upload arbitrary files that could lead to remote code execution.

If an attacker managed to exploit these flaws on a WordPress site running a vulnerable version of the plugin, they could take over the site which could have consequences including backdoors, spam injections, malicious redirects and other malicious activities, according to a new report from Wordfence's Chloe Chamberland.

Vulnerable WordPress sites

After discovering these three vulnerabilities, Wordfence initially tried to reach out Responsive Menu's parent company ExpressTech but received no response. From there, the researchers tried to contact the creators of the plugin on their site but once again received no response. Finally, Wordfence got in touch with the WordPress Plugins team who were able to establish contact between the company and Responsive Menu.

Wordfence and Responsive Menu worked to resolve the plugin's issues and a patch was released in mid-January. As all three flaws are quite serious, users of the plugin should update to the latest patched version (4.04).

However, at the time of writing, 65 percent of users are still running vulnerable versions of Responsive Menu according to data from its page on WordPress.org. In fact, just over 50,000 new downloads have been recorded which means that another 50,000 sites are still vulnerable to site takeover attacks.

If your WordPress site is running the Responsive Menu plugin, you should download and install version 4.04 immediately to prevent falling victim to any potential attacks.

Via BleepingComputer

TOPICS
Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home. 

Latest in Security
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Code Skull
Interpol operation arrests 300 suspects linked to African cybercrime rings
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Multiple routers hit by new critical severity remote command injection vulnerability, with no fix in sight
Code Skull
This dangerous new ransomware is hitting Windows, ARM, ESXi systems
An abstract image of a lock against a digital background, denoting cybersecurity.
Critical security flaw in Next.js could spell big trouble for JavaScript users
Latest in News
DeepSeek
DeepSeek’s new AI is smarter, faster, cheaper, and a real rival to OpenAI's models
Open AI
OpenAI unveiled image generation for 4o – here's everything you need to know about the ChatGPT upgrade
Apple WWDC 2025 announced
Apple just announced WWDC 2025 starts on June 9, and we'll all be watching the opening event
Hornet swings their weapon in mid air
Hollow Knight: Silksong gets new Steam metadata changes, convincing everyone and their mother that the game is finally releasing this year
OpenAI logo
OpenAI just launched a free ChatGPT bible that will help you master the AI chatbot and Sora
An aerial view of an Instavolt Superhub for charging electric vehicles
Forget gas stations – EV charging Superhubs are using solar power to solve the most annoying thing about electric motoring