CVE-2012-1011: actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access...

Security readout for executives and security teams

This old WordPress plugin flaw could let an unauthenticated attacker upload a PHP file and run it on the site. In business terms, a vulnerable site could be taken over, used to host malicious content, or become a foothold into related systems. Exposure is likely limited to legacy WordPress sites that installed the AllWebMenus WordPress Menu Plugin, especially version 1.1.8 or versions before 1.1.9. The provided CVE metadata lacks CPEs and normalized affected-product entries, so asset discovery must verify plugin presence directly. Prioritize remediation on any internet-facing WordPress site where this plugin exists. The vulnerability enables remote code execution behavior, but the affected software is old and evidence of current exploitation is not provided. Mitigation focus: Identify WordPress sites running the AllWebMenus WordPress Menu Plugin.; Upgrade to a fixed vendor-supported version, indicated by advisories as 1.1.9 or later.; Remove the plugin if it is unused or no maintained version is available..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.