CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The VM Menu Reorder plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the vm_set_to_default function. This makes it possible for unauthenticated attackers to reset all menu reordering settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
The VM Menu Reorder plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized menu reordering actions on behalf of an authenticated site administrator. The vulnerability requires the administrator to visit a malicious webpage while logged in. An attacker cannot read sensitive data or crash the site, but can modify menu structure without authorization.
What an attacker can do
Modify site menus without authorization by tricking an admin into visiting a malicious page.
Potential impact on your site
Menus can be reordered or altered without your knowledge or consent if an admin visits a malicious link.
Conditions required to exploit
Site admin must be logged in and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
