CVE-2025-2871

Description

The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated attackers to update any user meta to a value of one, including wp_capabilities which could result in a privilege deescalation of an administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Reserved 2025-03-27 | Published 2025-04-12 | Updated 2025-04-14 | Assigner Wordfence

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

*
affected

Timeline

2025-04-11:

Disclosed

Credits

Peter Thaleikis finder

References

www.wordfence.com/...-54d6-4f0e-b60f-1c7fa6ff24ea?source=cve

plugins.trac.wordpress.org/...tags/3.2.0/lib/class-admin.php

plugins.trac.wordpress.org/...tags/3.2.1/lib/class-admin.php

cve.org (CVE-2025-2871)

nvd.nist.gov (CVE-2025-2871)

Download JSON