CVE-2024-54381: Advance Menu Manager Auth Bypass Flaw

CVE-2024-54381 Overview

CVE-2024-54381 is a Missing Authorization vulnerability [CWE-862] affecting the Dotstore Advance Menu Manager plugin for WordPress. The flaw impacts all versions of advance-menu-manager up to and including 3.1.1. Authenticated attackers with low-privilege accounts can modify plugin settings without proper authorization checks. The vulnerability enables unauthorized changes to menu configurations that authorized administrators normally control. Exploitation requires network access and low privileges but no user interaction. The issue affects the integrity of plugin configuration and can result in limited availability impact on the WordPress site.

Critical Impact
Authenticated users with minimal privileges can alter plugin settings, potentially disrupting site navigation and menu functionality across WordPress installations running vulnerable versions of Advance Menu Manager.

Affected Products

Dotstore Advance Menu Manager WordPress Plugin (advance-menu-manager)
All versions from initial release through 3.1.1
WordPress sites with the plugin installed and activated

Discovery Timeline

2024-12-18 - CVE-2024-54381 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54381

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the Advance Menu Manager plugin's settings-handling code. The plugin exposes actions that modify configuration data without verifying whether the requesting user has the required capability. Any authenticated user, including subscriber-level accounts, can invoke these endpoints to change plugin settings. The issue affects integrity primarily, with a secondary availability impact when malformed or malicious configurations disrupt menu rendering.

Root Cause

The root cause is an authorization gap classified as CWE-862 (Missing Authorization). The plugin's settings handlers do not call WordPress capability checks such as current_user_can() before applying changes. This omission allows any authenticated session to reach code paths intended only for administrators. Nonce verification alone, if present, does not enforce the required privilege boundary.

Attack Vector

An attacker needs an authenticated WordPress account on the target site to exploit CVE-2024-54381. Registration-open sites and multi-user environments face the highest exposure. The attacker sends a crafted request to the plugin's settings endpoint, typically through admin-ajax.php or a dedicated plugin action. Because no capability check gates the handler, the server processes the request and updates the stored settings. The technical details are documented in the Patchstack WordPress Plugin Advisory.

Detection Methods for CVE-2024-54381

Indicators of Compromise

Unexpected modifications to Advance Menu Manager settings recorded in the wp_options table
POST requests to admin-ajax.php referencing plugin-specific actions originating from low-privilege user sessions
Menu structure or display changes on the WordPress site that were not initiated by an administrator
Audit log entries showing subscriber or contributor accounts issuing settings-modification requests

Detection Strategies

Monitor WordPress activity logs for settings changes attributed to non-administrator accounts
Inspect web server access logs for HTTP requests to plugin AJAX endpoints from unexpected user IDs
Review database change history for unauthorized updates to plugin option entries
Deploy a Web Application Firewall (WAF) rule to flag settings-modification requests from low-privilege sessions

Monitoring Recommendations

Enable WordPress user activity logging with capability-level context to attribute configuration changes
Alert on new or modified plugin option rows when the initiating user lacks administrator capability
Track sudden increases in traffic to plugin admin endpoints, especially from newly registered accounts

How to Mitigate CVE-2024-54381

Immediate Actions Required

Identify all WordPress installations running Advance Menu Manager version 3.1.1 or earlier
Restrict new user registration on affected sites until a patched version is deployed
Audit existing user accounts and remove or downgrade unnecessary low-privilege accounts
Review current plugin settings for unauthorized modifications and restore known-good configurations

Patch Information

Refer to the Patchstack WordPress Plugin Advisory for vendor patch status and upgrade guidance. Apply any available update beyond version 3.1.1 as soon as the vendor releases a fixed build. If no patch is available, consider removing the plugin until a fix is provided.

Workarounds

Deactivate and remove the Advance Menu Manager plugin until a patched version is available
Configure a WAF rule to block requests to plugin settings endpoints from non-administrator sessions
Disable open user registration through Settings → General to shrink the attack surface
Use a WordPress security plugin to enforce capability checks on the affected AJAX actions

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0

# List installed plugin version to identify vulnerable sites
wp plugin get advance-menu-manager --field=version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate advance-menu-manager