Description
WordPress Plugin Admin Menu Tree Page View is prone to multiple vulnerabilities, including cross-site request forgery and privilege escalation vulnerabilities. Exploiting these issues could allow an attacker to perform certain administrative actions and gain unauthorized access to the affected application, or to create arbitrary posts. WordPress Plugin Admin Menu Tree Page View version 2.6.9 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.7 or latest
References
http://pvagenas.com/vulnerabilities/admin-menu-tree-page-view-csrf-privilege-escalation/
https://pvagenas.com/vulnerabilities/admin-menu-tree-page-view-csrf-privilege-escalation-2/
https://www.exploit-db.com/exploits/43486/
https://plugins.svn.wordpress.org/admin-menu-tree-page-view/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Yoast SEO Information Disclosure (3.2.4)
WordPress 3.9.x Multiple Vulnerabilities (3.9 - 3.9.19)
phpMyFAQ Cleartext Transmission of Sensitive Information Vulnerability (CVE-2022-4409)
Oracle JRE CVE-2012-1531 Vulnerability (CVE-2012-1531)
WordPress Plugin Bitcoin/Altcoin Faucet Cross-Site Request Forgery (1.6.0)