CVE-2025-30543

Vulnerability

The Menu Duplicator WordPress plugin (copy-menu) versions up to 1.0 contain a missing authorization vulnerability. The plugin fails to properly enforce access control checks, allowing exploitation of incorrectly configured access control security levels. The plugin has been closed and removed from the WordPress.org plugin directory as of March 11, 2025 due to a security issue [1].

Exploitation

An attacker with network access to the WordPress site can exploit the missing authorization to perform menu duplication operations without proper authentication or privileges. The exact exploitation steps are not disclosed in the available references, but the vulnerability is classified as missing authorization, indicating that the plugin does not verify user capabilities before executing sensitive actions.

Impact

Successful exploitation allows an attacker to duplicate menus without authorization, potentially leading to unauthorized modifications to site navigation. The impact is limited to menu duplication functionality, but could be combined with other vulnerabilities for further compromise. The CVSS score of 4.3 (Medium) reflects the moderate severity.

Mitigation

No patched version is available. The plugin has been closed and removed from the WordPress.org plugin directory as of March 11, 2025 [1]. Users who have the plugin installed should uninstall it immediately. No workaround is known. Since the plugin is no longer maintained, migration to an alternative menu management solution is recommended.