The Superfly Responsive Menu WordPress plugin is vulnerable to CSRF due to inadequate nonce validation in the ajax_handle_delete_icons() function in versions up to 5.0.29. This flaw enables attackers to craft forged requests that, when executed by an authenticated administrator, can delete arbitrary files. The initial CSRF patch was released in version 5.0.28, but it did not fully address directory traversal issues, which were mitigated starting from version 5.0.30.

Successful exploitation can lead to deletion of arbitrary files on the affected system, resulting in potential loss of data, service disruption, and compromise of site integrity. The vulnerability requires tricking an authenticated administrator into performing an action, but no privileges are needed to initiate the attack. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Upgrade the Superfly Responsive Menu plugin to version 5.0.30 or later to ensure both CSRF and directory traversal protections are in place. Versions 5.0.28 and 5.0.29 only partially address the issue and are not sufficient. No other mitigations are indicated by the vendor advisory.