WordPress Superfly Menu Plugin <= 5.0.29 is vulnerable to Cross Site Request Forgery (CSRF)

[Blodarn]

Cross Site Request Forgery (CSRF)

This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication.

This is a general description of this vulnerability type, specific impact varies case by case. CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way, but it is not ideal for WordPress.

See : https://patchstack.com/database/vulnerability/superfly-menu/wordpress-superfly-responsive-menu-plugin-5-0-29-cross-site-request-forgery-to-arbitrary-file-deletion-vulnerability?_a_id=241

[christian]

Hey @Blodarn,

Thank you for reporting the issue. We’ll check if there is a Superfly update and see if we can push it as soon as possible.

[rubin]

Hey There,

Version 5.0.30 is available via automatic updates. Make sure that you X/Pro installation is validated. All the best!

[Blodarn]

Thank you !

[marc_a]

Hey @Blodarn,

You’re most welcome!