CVE-2024-2405

Float menu < 6.0.1 - Menu Deletion via CSRF

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.

Affected

Float menu

CVSS v3.1 CNA

4.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

EPSS

0.28% chance of exploitation in the next 30 days, 19th percentile

Published

2024-05-02

Updated

2024-08-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c42ffa15-6ebe-4c70-9e51-b95bd05ea04d/

Security advisories

• https://wpscan.com/vulnerability/c42ffa15-6ebe-4c70-9e51-b95bd05ea04d

References

• CVE Record
• NVD entry