8.8

CVE-2021-24160: expresstech responsive_menu

CVSS: 8.8v3.1HighModified
Published 05-04-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-24160 is a high (CVSS 8.8) vulnerability in expresstech responsive_menu. EPSS estimates a 8.20% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
47/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
8.20%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference

Timeline

  1. 05-04-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

8.20%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.20% on 19-09-2026

19-09-202619-10-2026
EPSS score
8.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (wpscan.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (wordfence.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Expresstech3 products
Wordpress1 product
  • responsive-menu≥ 4.0, < 4.0.4

2 vendors · 4 products

References

3 links