The plugin Side Menu was closed on the WordPress Plugin Directory on Wednesday. On Friday a new version was submitted with the changelog entry “Fixed: Security parameters”. While checking over the vulnerability that was fixed in that version, we found yet another vulnerability still exists in the plugin. That vulnerability being a cross-site request forgery (CSRF)/local file inclusion (LFI) vulnerability.

Based on this vulnerability we have improved our Plugin Security Checker’s detection of LFI vulnerabilities to flag code like the code that is in this plugin. So you can check plugins you use to see if they might have similar issues with that tool. [Read more]