CVE-2024-3593
📋 TL;DR
The UberMenu WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 3.8.3. This allows unauthenticated attackers to delete or reset the plugin's settings by tricking an administrator into clicking a malicious link. All WordPress sites using vulnerable versions of UberMenu are affected.
💻 Affected Systems
- UberMenu WordPress Mega Menu Plugin
📦 What is this software?
Ubermenu by Sevenspark
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of menu configuration requiring manual restoration, potential site navigation disruption, and administrative overhead to reconfigure menus.
Likely Case
Temporary disruption of site navigation menus until settings are restored, requiring administrator intervention to fix.
If Mitigated
No impact if proper CSRF protections are in place or the vulnerability is patched.
🎯 Exploit Status
Exploitation requires social engineering to trick an administrator into clicking a malicious link. No authentication required for the CSRF attack itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.8.4 or later
Vendor Advisory: https://codecanyon.net/item/ubermenu-wordpress-mega-menu-plugin/154703
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find UberMenu and click 'Update Now' if available. 4. If no update appears, download version 3.8.4+ from CodeCanyon and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDeactivate UberMenu plugin until patched to prevent exploitation
wp plugin deactivate ubermenu
🧯 If You Can't Patch
- Implement strict access controls limiting admin panel access to trusted networks only
- Use browser extensions that block CSRF attacks or implement additional WordPress security plugins with CSRF protection
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > UberMenu version. If version is 3.8.3 or lower, you are vulnerable.Check Version:
wp plugin get ubermenu --field=versionVerify Fix Applied:
After updating, verify UberMenu version shows 3.8.4 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- WordPress admin logs showing unauthorized settings deletion/reset
- Unexpected POST requests to admin-ajax.php with ubermenu_delete_all_item_settings or ubermenu_reset_settings actions
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with CSRF-like parameters targeting UberMenu functions
SIEM Query:
source="wordpress" AND (action="ubermenu_delete_all_item_settings" OR action="ubermenu_reset_settings")🔗 References
- https://codecanyon.net/item/ubermenu-wordpress-mega-menu-plugin/154703
- https://www.wordfence.com/threat-intel/vulnerabilities/id/621ef583-bf99-4b81-ae9c-b4f1c86b86aa?source=cve
- https://codecanyon.net/item/ubermenu-wordpress-mega-menu-plugin/154703
- https://www.wordfence.com/threat-intel/vulnerabilities/id/621ef583-bf99-4b81-ae9c-b4f1c86b86aa?source=cve
