title: Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload
description: In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: Responsive Menu – Create Mobile-Friendly Menu
vendor: ExpressTech
versions:
lessThan: 4.0.4, status: affected, version: 4.0.4, versionType: custom
}
{
product: Responsive Menu Pro
vendor: ExpressTech
versions:
lessThan: 4.0.4, status: affected, version: 4.0.4, versionType: custom
}
