CVE-2022-25602

Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).

Score

CVSS 3.1 8.8 High

Status

Modified - audit@patchstack.com

Published

2022-03-18

Last modified

2026-04-28

Weaknesses

CWE-200, CWE-434

Affected products

• Responsive Menu (Expresstech)
• Responsive Menu Wordpress Plugin (Expresstech)

References

• https://patchstack.com/database/vulnerability/responsive-menu/wordpress-responsive-menu-plugin-4-1-7-nonce-token-leak-l…
• https://wordpress.org/plugins/responsive-menu/#developers