EUVD-2026-51939
GHSA-m349-rc55-q5w8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber-level account required (PR:L); AJAX endpoint is network-reachable; impact is integrity-only on menu content with no scope change, confidentiality, or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
AnalysisAI
Clever Mega Menu for Visual Composer (WordPress plugin, versions through 1.0.1) allows any authenticated user with as little as Subscriber-level access to overwrite navigation menu item content and settings through an unprotected AJAX endpoint. The plugin fails to perform either a nonce check or a capability check before processing menu item metadata updates, meaning WordPress role-based access control over menu management is completely bypassed. A publicly available exploit exists via WPScan, though EPSS places exploitation probability at 0.14% (4th percentile) with no CISA KEV listing, indicating limited observed exploitation at time of analysis.
Technical ContextAI
The affected product is the Clever Mega Menu for Visual Composer WordPress plugin (CPE: cpe:2.3:a:unknown:clever_mega_menu_for_visual_composer:*:*:*:*:*:*:*:*), versions up to and including 1.0.1. The vulnerability is classified as CWE-284 (Improper Access Control): a WordPress AJAX action handler that processes navigation menu item metadata updates performs neither nonce verification (which prevents CSRF and validates request origin) nor a capability check (which restricts the action to sufficiently privileged users, typically holding 'edit_theme_options' or equivalent). WordPress plugins register AJAX handlers via add_action('wp_ajax_*'); this handler is accessible to authenticated users but omits the wp_verify_nonce() and current_user_can() guards that must gate all write operations. The result is that the WordPress role system's access control for menu management is entirely circumvented for the duration the plugin remains active.
RemediationAI
No vendor-released patch has been identified at time of analysis - no fixed version beyond 1.0.1 is confirmed by any available source. The primary recommended action is to deactivate and remove the Clever Mega Menu for Visual Composer plugin until the vendor releases a patched version. As a compensating control, administrators should disable open user registration if it is not operationally required, since exploitation depends on possessing a valid WordPress account; this raises the barrier significantly without affecting existing authenticated users. If the plugin must remain active, auditing and removing unnecessary low-privilege accounts reduces the attacker pool. A web application firewall rule targeting the specific AJAX action name used by the plugin can provide detection and blocking coverage without service disruption. Monitor the WPScan advisory at https://wpscan.com/vulnerability/23c9232c-73e1-477e-a0b5-bceebb6ab6dd/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-11872 for patch availability updates.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today