CVE-2021-24942

Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution

The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.

Affected

Menu Item Visibility Control

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.24% chance of exploitation in the next 30 days, 69th percentile

Published

2022-12-26

Updated

2025-04-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/eaa28832-74c1-4cd5-9b0f-02338e23b418

References

• CVE Record
• NVD entry