CVEs-PoC/2021/CVE-2021-24161.md

### [CVE-2021-24161](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24161)
![](https://img.shields.io/static/v1?label=Product&message=Responsive%20Menu%20%E2%80%93%20Create%20Mobile-Friendly%20Menu&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Responsive%20Menu%20Pro&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=4.0.4%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen)

### Description

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.

### POC

#### Reference
- https://wpscan.com/vulnerability/efca27e0-bdb6-4497-8330-081f909d6933

#### Github
- https://github.com/20142995/nuclei-templates