Platform
wordpress
Component
stm-megamenu
Fixed in
2.3.13
CVE-2024-35677 describes a Path Traversal vulnerability within the StylemixThemes MegaMenu WordPress plugin. This vulnerability allows an attacker to include arbitrary files on the server, potentially leading to remote code execution and complete system compromise. The vulnerability affects versions of MegaMenu up to and including 2.3.12, with a fix available in version 2.3.13.
The Path Traversal vulnerability in StylemixThemes MegaMenu is particularly dangerous because it allows for PHP Local File Inclusion (LFI). An attacker can leverage this to read sensitive files, such as configuration files containing database credentials or application code. More critically, they could include PHP files containing malicious code, leading to remote code execution (RCE). This could grant the attacker full control over the WordPress server, enabling them to steal data, modify the website, or use the server as a launchpad for further attacks. The potential blast radius extends to any data stored on the server and any systems accessible from the compromised WordPress instance.
CVE-2024-35677 was publicly disclosed on June 10, 2024. While no active exploitation campaigns have been definitively confirmed, the vulnerability's CRITICAL severity and ease of exploitation make it a high-priority target. The vulnerability is not currently listed on CISA KEV, but its potential impact warrants close monitoring. Public proof-of-concept exploits are likely to emerge, increasing the risk of widespread exploitation.
Exploit Status
EPSS
0.65% (71% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-35677 is to immediately upgrade StylemixThemes MegaMenu to version 2.3.13 or later. If upgrading is not immediately feasible, implement temporary workarounds. These include restricting file access permissions to the MegaMenu plugin directory, implementing strict input validation to sanitize any user-supplied data used in file paths, and utilizing a Web Application Firewall (WAF) to block requests containing suspicious path traversal patterns. Consider using a WAF rule that denies requests containing directory traversal sequences like '../'. After upgrading, confirm the fix by attempting to access a non-existent file through the MegaMenu interface and verifying that access is denied.
Update the MegaMenu plugin to the latest available version. The vulnerability exists in versions prior to the most recent. To update, go to the WordPress admin panel, 'Plugins' section, and search for 'MegaMenu' to update it.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-35677 is a critical Path Traversal vulnerability in the StylemixThemes MegaMenu WordPress plugin, allowing attackers to include arbitrary files on the server.
You are affected if you are using StylemixThemes MegaMenu version 2.3.12 or earlier. Upgrade to version 2.3.13 to mitigate the risk.
The recommended fix is to upgrade StylemixThemes MegaMenu to version 2.3.13. As a temporary workaround, implement strict file access controls and input validation.
While no active exploitation campaigns have been definitively confirmed, the vulnerability's severity makes it a high-priority target and exploitation is likely.
Refer to the StylemixThemes website and WordPress plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.