CVE-2021-4443criticalobserved exploitationCWE-434

CVE-2021-4443: critical vulnerability in quadlayers QuadMenu – Mega Menu

WordPress Mega Menu <= 2.0.6 - Arbitrary File Creation

Published · Updated

Follow this CVE+ Monitor QuadMenu – Mega Menu

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 9.8epss 0.7%
from disclosure to weapon
Published on NVDOct 16
VulnCheckOct 15
The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
quadlayers · QuadMenu – Mega Menu
Related CVEs — quadlayers QuadMenu – Mega Menu

In the same product, most dangerous first.

CVE-2025-2871MEDIUMWordPress Mega Menu – QuadMenu <= 3.2.0 - Cross-Site Request Forgery to Limited User Meta UpdateEPSS 0.2%