Description
WordPress Plugin Admin Menu Tree Page View is prone to multiple vulnerabilities, including cross-site request forgery and privilege escalation vulnerabilities. Exploiting these issues could allow an attacker to perform certain administrative actions and gain unauthorized access to the affected application, or to create arbitrary posts. WordPress Plugin Admin Menu Tree Page View version 2.6.9 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.7 or latest
References
http://pvagenas.com/vulnerabilities/admin-menu-tree-page-view-csrf-privilege-escalation/
https://pvagenas.com/vulnerabilities/admin-menu-tree-page-view-csrf-privilege-escalation-2/
https://www.exploit-db.com/exploits/43486/
https://plugins.svn.wordpress.org/admin-menu-tree-page-view/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin WordPress Filter Gallery Cross-Site Scripting (0.1.5)
WordPress Plugin Auto Attachments TimThumb Arbitrary File Upload (0.3)
PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-3007)
Magento XML Injection (aka Blind XPath Injection) Vulnerability (CVE-2019-8158)