Hero Mega Menu WordPress Plugin Arbitrary Directory Deletion Vulnerability
Vulnerability
A vulnerability allowing arbitrary file deletion has been identified in the Hero Mega Menu - Responsive WordPress Menu Plugin, affecting all versions through 1.16.5. The issue arises from inadequate file path validation in the hmenu_delete_menu() function, enabling unauthenticated attackers to delete arbitrary directories on the server.
Impact
Exploitation of this vulnerability allows for unauthorized deletion of directories on the server, which could lead to loss of data or disruption of service.
Remediation
No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.