What’s Vulnerable › Vulnerabilities

CVE-2021-24942: Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-26 · updated 2026-06-17

Description

The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.

Affected products

• Menu Item Visibility Control: through 0.5

References

• https://wpscan.com/vulnerability/eaa28832-74c1-4cd5-9b0f-02338e23b418
• https://wpscan.com/vulnerability/eaa28832-74c1-4cd5-9b0f-02338e23b418

Get alerted when CVE-2021-24942 or the next vulnerability affects your stack