Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-13780: Hero Mega Menu Plugin Can Delete Any File on Server

CVE-2024-13780 · published 1 year ago

Summary

The Hero Mega Menu plugin for WordPress can be exploited by attackers to delete any file on the server, even without a password. This is a serious issue because it could lead to data loss or disruption of your website. To protect your site, update the plugin to the latest version, 1.16.6, or remove it if you don't use it.

Original advisory text

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the hmenu_delete_menu() function in all versions up to, and including, 1.16.5. This makes it possible for unauthenticated attackers to delete arbitrary directories on the server.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published5 Mar 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-13780 · NVD

Track software like this

Free during beta