High · 8.3 CVE-2022-25602 EUVD-2022-30262GHSA-g6mw-6vmq-3w32

WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability

Published Mar 18, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: ExpressTech Systems Product: Responsive Menu (WordPress plugin) Category: Web / CMS

Description

Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).

Affected products

Vendor	Product	Affected	Fixed
ExpressTech	Responsive Menu (WordPress plugin)	<= 4.1.7 – ≤ 4.1.7	—

References

https://wordpress.org/plugins/responsive-menu/#developers
https://patchstack.com/database/vulnerability/responsive-menu/wordpress-responsive-menu-plugin-4-1-7-nonce-token-leak-leading-to-arbitrary-file-upload-theme-deletion-plugin-settings-change-vulnerability