WordPress Mega Menu QuadMenu Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Mega Menu - QuadMenu plugin, affecting all versions through 3.2.0. The issue arises from inadequate nonce validation in the 'ajax_dismiss_notice()' function, allowing unauthenticated attackers to manipulate user meta data. This includes the 'wp_capabilities' meta, which could be exploited to downgrade an administrator's privileges. The vulnerability requires tricking an administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in user meta data, including critical capability settings, potentially allowing for privilege escalation or de-escalation.

Remediation

Users are advised to update the WordPress Mega Menu - QuadMenu plugin to version 3.2.1 or later.