CVE-2022-25602 HIGH

CVE-2022-25602: WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability

Vendor Expresstech
Product Responsive Menu (WordPress plugin)
Weakness CWE-200 · Info exposure
Published March 18, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).

Explanation of Vulnerability in Simple Terms

02Summary

The Responsive Menu WordPress plugin through version 4.1.7 contains an information exposure vulnerability that allows authenticated users with low privileges to read sensitive data. The plugin fails to properly restrict access to certain functions, exposing configuration details and potentially other site information. An attacker with a basic user account can exploit this without user interaction.

What an attacker can do

03Attacker Capabilities

Read sensitive plugin configuration and site data that should be restricted to administrators.

Potential impact on your site

04Site Impact

Unauthorized users can access sensitive plugin settings and potentially other restricted information on your site.

Conditions required to exploit

05Prerequisites

Attacker needs a low-privilege WordPress user account (subscriber or contributor level).

Key dates

06Disclosure timeline

March 18, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-4126 Table Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute CVE-2026-4020 Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API CVE-2026-1582 WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling CVE-2026-2128 Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie CVE-2026-1980 WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure