EUVD-2025-17233Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L due to required authentication; low integrity impact only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Missing Authorization vulnerability in ThemeHunk ThemeHunk allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThemeHunk: from n/a through 1.1.1.
AnalysisAI
Missing authorization in ThemeHunk plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings or data. The vulnerability affects versions up to 1.1.1, with no public exploit or active exploitation reported.
Technical ContextAI
The vulnerability is a Missing Authorization (CWE-862) in the ThemeHunk plugin, which is a WordPress plugin for mega menus. The CPE indicates the affected product is themehunk:mega_menu for WordPress. The root cause is that the plugin fails to properly enforce access control checks on certain functionality, allowing users with low privileges (e.g., subscribers) to perform actions intended for higher-privileged users.
RemediationAI
Update ThemeHunk plugin to version 1.1.2 or later, as per vendor advisory. No workarounds are documented; ensure proper access control configurations and review user roles. The advisory URL is https://patchstack.com/database/wordpress/plugin/themehunk-megamenu-plus/vulnerability/wordpress-themehunk-1-1-1-broken-access-control-vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu
The Easy Mega Menu Plugin for WordPress - ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a m
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today