CVE-2013-4230: The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 fo...

Security readout for executives and security teams

CVE-2013-4230 affects the mm_webform submodule in Drupal’s Monster Menus module. An authenticated user who already has permission to read submitted webform data could delete submissions they should not be able to delete. The main business impact is unauthorized loss of form-submission records, not unauthenticated takeover. Exposure is likely limited to Drupal sites using the Monster Menus module with mm_webform enabled, on versions below 6.x-6.61 or 7.x-1.13. Risk depends on whether non-admin authenticated users hold the affected webform submission read permission. Treat as a targeted data-integrity risk for legacy Drupal deployments. Prioritize if the site stores important webform submissions and grants submission read access beyond a small trusted admin group. It is lower urgency than unauthenticated remote code execution but should not remain unresolved on exposed production sites. Mitigation focus: Upgrade Monster Menus to 6.x-6.61, 7.x-1.13, or later supported guidance.; Review Drupal roles with webform submission read-data permissions.; Restrict affected permissions to trusted administrative users only..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.