CVE-2025-2871

The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated attackers to update any user meta to a value of one, including wp_capabilities which could result in a privilege deescalation of an administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/quadmenu/tags/3.2.0/lib/class-admin.php#L105
https://plugins.trac.wordpress.org/changeset/3270825/quadmenu/tags/3.2.1/lib/class-admin.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba7b675-54d6-4f0e-b60f-1c7fa6ff24ea?source=cve

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El complemento Mega Menú – QuadMenu de WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 3.2.0 incluida. Esto se debe a una validación de nonce inexistente o incorrecta en la función ajax_dismiss_notice(). Esto permite a atacantes no autenticados actualizar cualquier metadatos de usuario a un valor de uno, incluyendo wp_capabilities, lo que podría resultar en la pérdida de privilegios de un administrador mediante una solicitud falsificada, ya que pueden engañar al administrador del sitio para que realice una acción como hacer clic en un enlace.

12 Apr 2025, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-12 04:15

Updated : 2026-06-17 09:07

NVD link : CVE-2025-2871

Mitre link : CVE-2025-2871

CVE.ORG link : CVE-2025-2871

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-2871", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2871", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-14T16:27:26.139304Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "quadlayers", "product": "QuadMenu \u2013 Mega Menu", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-04-12T04:15:39.283", "references": [{"url": "https://plugins.trac.wordpress.org/browser/quadmenu/tags/3.2.0/lib/class-admin.php#L105", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3270825/quadmenu/tags/3.2.1/lib/class-admin.php", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba7b675-54d6-4f0e-b60f-1c7fa6ff24ea?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The WordPress Mega Menu \u2013 QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated attackers to update any user meta to a value of one, including wp_capabilities which could result in a privilege deescalation of an administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Mega Men\u00fa \u2013 QuadMenu de WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 3.2.0 incluida. Esto se debe a una validaci\u00f3n de nonce inexistente o incorrecta en la funci\u00f3n ajax_dismiss_notice(). Esto permite a atacantes no autenticados actualizar cualquier metadatos de usuario a un valor de uno, incluyendo wp_capabilities, lo que podr\u00eda resultar en la p\u00e9rdida de privilegios de un administrador mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "lastModified": "2026-06-17T09:07:46.317", "sourceIdentifier": "security@wordfence.com"}