Read the docs
TI-2021-06452 Aliases CVE-2021-24160GHSA-fjhj-x5j3-wcrf

Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload

Priority MEDIUM 49CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.

Why it matters now

EPSS 0.08196 94th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Responsive Menu – Create Mobile-Friendly Menu (ExpressTech): 4.0.4Responsive Menu Pro (ExpressTech): 4.0.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ExpressTechResponsive Menu – Create Mobile-Friendly Menu4.0.4 to before 4.0.44.0.4Patch availableCNA
ExpressTechResponsive Menu Pro4.0.4 to before 4.0.44.0.4Patch availableCNA
  • Responsive Menu – Create Mobile-Friendly Menu VendorExpressTech Affected 4.0.4 to before 4.0.4 Fixed in 4.0.4 Patch available CNA
  • Responsive Menu Pro VendorExpressTech Affected 4.0.4 to before 4.0.4 Fixed in 4.0.4 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:expresstech:responsive_menu:*:*:*:*:free:wordpress:*:*before 4.0.4VulnerableExpressTech
cpe:2.3:a:expresstech:responsive_menu:*:*:*:*:pro:wordpress:*:*before 4.0.4VulnerableExpressTech
  • cpe:2.3:a:expresstech:responsive_menu:*:*:*:*:free:wordpress:*:* Versions before 4.0.4 Vulnerable ·ExpressTech
  • cpe:2.3:a:expresstech:responsive_menu:*:*:*:*:pro:wordpress:*:* Versions before 4.0.4 Vulnerable ·ExpressTech

Remediation

  • Fix · CNA Responsive Menu – Create Mobile-Friendly Menu (ExpressTech) Fixed in 4.0.4
  • Fix · CNA Responsive Menu Pro (ExpressTech) Fixed in 4.0.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ExpressTech Responsive Menu Pro, Responsive Menu – Create Mobile-Friendly Menu 4.0.4

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-06453 Responsive Menu < 4.0.4 - CSRF to Arbitrary File UploadPriority MEDIUM 41
    • TI-2021-06454 Responsive Menu < 4.0.4 - CSRF to Settings UpdatePriority LOW 39
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24160
  2. 2026-10-03 Alias added: GHSA-fjhj-x5j3-wcrf

References

Exploit 2

  • TI-2022-09192 Information disclosure in ExpressTech Responsive Menu CVSS 3.1HIGH 8.8
  • TI-2021-06453 Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload CVSS 3.1HIGH 8.8
  • TI-2021-06454 Responsive Menu < 4.0.4 - CSRF to Settings Update CVSS 3.1HIGH 8.8
  • TI-2017-13686 The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. CVSS 3.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences