CVE-2024-35677

CRITICAL 9.8CVE-2024-35677 · Published 10/06/2024 · updated 17/06/2026

In short

CVE-2024-35677 is a CRITICAL (CVSS 9.8) vulnerability affecting mega menu (stylemixthemes).
Chance of exploitation in the next 30 days (EPSS): 0.54%, higher than 45.6% of all vulnerabilities.
Fix: update to 2.3.13 or later.

Package	Affected versions	Patched versions
mega menu stylemixthemes	`< 2.3.13`	`2.3.13`

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu allows PHP Local File Inclusion.This issue affects MegaMenu: from n/a through 2.3.12.

References

patchstack.com/database/vulnerability/stm-megamenu/wordpress-megamenu-plugin-2-3-12-unauthenticated-local-file-inclusion-vulnerability · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free