EUVD-2025-17233Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySend crafted HTTP request to vulnerable endpoint
-
ExploitBypass authorization check
-
ExecutionModify menu settings or data
-
ImpactImpact integrity of site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid WordPress user account with at least subscriber-level privileges. The vulnerability is present in the ThemeHunk plugin versions up to 1.1.1. No special configuration is needed beyond having the plugin installed and activated. |
| Impact | CVSS 3.1 score 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates low risk: requires low-privileged authentication, no user interaction, and only low integrity impact. EPSS score is 0.05% (low probability of exploitation). No KEV listing or public exploit identified. The vulnerability is not actively exploited and has low real-world risk despite being network-accessible. |
| Exploit ScenarioDerived | An authenticated attacker with subscriber-level access sends a crafted request to a vulnerable endpoint in the ThemeHunk plugin, bypassing authorization checks to modify menu settings or other data, potentially defacing the site or altering navigation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Missing authorization in ThemeHunk plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially leading to unauthorized modification of settings or data. The vulnerability affects versions up to 1.1.1, with no public exploit or active exploitation reported.
RemediationAI
Update ThemeHunk plugin to version 1.1.2 or later, as per vendor advisory. No workarounds are documented; ensure proper access control configurations and review user roles. The advisory URL is https://patchstack.com/database/wordpress/plugin/themehunk-megamenu-plus/vulnerability/wordpress-themehunk-1-1-1-broken-access-control-vulnerability
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a Missing Authorization (CWE-862) in the ThemeHunk plugin, which is a WordPress plugin for mega menus. The CPE indicates the affected product is themehunk:mega_menu for WordPress. The root cause is that the plugin fails to properly enforce access control checks on certain functionality, allowing users with low privileges (e.g., subscribers) to perform actions intended for higher-privileged users.
Know when Mega Menu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L due to required authentication; low integrity impact only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in ThemeHunk ThemeHunk allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThemeHunk: from n/a through 1.1.1.
Executive ViewAI
Organizations using Missing Authorization vulnerability in ThemeHunk ThemeHunk should be aware of moderate risk from CVE-2025-30990, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu
The Easy Mega Menu Plugin for WordPress - ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a m
GitHub PoC
Exploit-DB