CVE-2021-24160

In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.

• CWE-434
• CWE-434

• https://wpscan.com/vulnerability/066ba5d4-4aaa-4462-b106-500c1f291c37Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/066ba5d4-4aaa-4462-b106-500c1f291c37Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/Exploit, Third Party Advisory

Published

Apr 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24155The WordPress Backup and Migrate Plugin – Backup Guard WordP…7.2
• CVE-2021-24156Stored Cross-Site Scripting vulnerabilities in Testimonial R…5.4
• CVE-2021-24157Orbit Fox by ThemeIsle has a feature to add custom scripts t…5.4
• CVE-2021-24158Orbit Fox by ThemeIsle has a feature to add a registration f…6.5
• CVE-2021-24159Due to the lack of sanitization and lack of nonce protection…8.8
• CVE-2021-2416Vulnerability in the Oracle Communications Session Border Co…4.9
• CVE-2021-24161In the Reponsive Menu (free and Pro) WordPress plugins befor…8.8
• CVE-2021-24162In the Reponsive Menu (free and Pro) WordPress plugins befor…8.8
• CVE-2021-24163The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_h…8.8
• CVE-2021-24164In the Ninja Forms Contact Form WordPress plugin before 3.4.…4.3
• CVE-2021-24165In the Ninja Forms Contact Form WordPress plugin before 3.4.…6.1
• CVE-2021-24166The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact…5.4