CVE-2024-3476 – The Side Menu Lite WordPress plugin before vers... (How to Fix)

Q: What is the severity of CVE-2024-3476?

CVE-2024-3476 has a CVSS score of 8.8 (HIGH). The Side Menu Lite WordPress plugin before version 4.2.1 lacks CSRF protection on certain bulk actions, allowing attackers to trick logged-in administrators into performing unauthorized actions like deleting menu buttons. This affects WordPress sites using vulnerable versions of the plugin with administrator accounts.

📋 TL;DR

The Side Menu Lite WordPress plugin before version 4.2.1 lacks CSRF protection on certain bulk actions, allowing attackers to trick logged-in administrators into performing unauthorized actions like deleting menu buttons. This affects WordPress sites using vulnerable versions of the plugin with administrator accounts.

💻 Affected Systems

Products:

Side Menu Lite WordPress plugin

Versions: All versions before 4.2.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the plugin enabled and an administrator logged in.

📦 What is this software?

Side Menu Lite by Wow Company

View all CVEs affecting Side Menu Lite →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could delete all menu buttons, disrupt site functionality, or potentially chain with other vulnerabilities for further compromise.

🟠

Likely Case

Unauthorized deletion of menu buttons leading to site navigation issues and requiring manual restoration.

🟢

If Mitigated

Minimal impact if CSRF tokens are implemented or administrators avoid suspicious links.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing, and CSRF attacks can be delivered via malicious links.

🏢 Internal Only: LOW - CSRF requires administrator interaction, making internal-only networks less susceptible unless administrators browse external sites.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires tricking an administrator into clicking a malicious link while logged in.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.2.1

Vendor Advisory: https://wpscan.com/vulnerability/46f74493-9082-48b2-90bc-2c1d1db64ccd/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Side Menu Lite and update to version 4.2.1 or later. 4. Verify update completes successfully.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily deactivate the Side Menu Lite plugin to prevent exploitation.

wp plugin deactivate side-menu-lite

🧯 If You Can't Patch

Restrict administrator access to trusted networks only.
Educate administrators to avoid clicking untrusted links while logged in.

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is below 4.2.1, it is vulnerable.

Check Version:

wp plugin get side-menu-lite --field=version

Verify Fix Applied:

Confirm plugin version is 4.2.1 or higher after update.

📡 Detection & Monitoring

Log Indicators:

Unusual bulk deletion actions in WordPress logs
CSRF-related errors in web server logs

Network Indicators:

HTTP POST requests to plugin admin endpoints without referrer headers

SIEM Query:

source="wordpress.log" AND "side-menu-lite" AND "delete" AND user_role="administrator"

📊 Metadata

CVE ID: CVE-2024-3476

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-352

Published: May 2, 2024

Last Updated: May 8, 2025

🔗 References

https://wpscan.com/vulnerability/46f74493-9082-48b2-90bc-2c1d1db64ccd/ Exploit,Third Party Advisory
https://wpscan.com/vulnerability/46f74493-9082-48b2-90bc-2c1d1db64ccd/ Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3476, you might also want to check these: