What is the CVSS score of CVE-2026-8688?

CVE-2026-8688 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Advance Nav Menu Manager CVE-2026-8688

EUVD-2026-38685 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-239x-hvpx-225m

WordPress Authentication Bypass Wordpress Plugin Advance Nav Menu Manager Krishaweb

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress plugin requires subscriber-level authentication (PR:L); impact is integrity-only and limited to nav menu items, with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 07:01 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to duplicate, copy, move, or publish nav_menu_item posts via wp_insert_post(), modifying the site's navigation menus without authorization.

AnalysisAI

Authorization bypass in the Advance Nav Menu Manager WordPress plugin (all versions through 1.3) permits any authenticated subscriber-level user to manipulate site navigation menus without authorization. The plugin invokes wp_insert_post() for nav_menu_item operations - duplicate, copy, move, and publish - without enforcing capability checks, allowing low-privilege users to alter navigation structure at will. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the low barrier to exploitation (any registered subscriber account) makes it a meaningful risk on sites with open or compromised user registration.

Technical ContextAI

The affected product is the Advance Nav Menu Manager WordPress plugin by krishaweb, CPE cpe:2.3:a:krishaweb:advance_nav_menu_manager:*:*:*:*:*:*:*:*, covering all releases up to and including version 1.3. The root cause is CWE-862 (Missing Authorization): WordPress plugins are expected to gate privileged operations with capability checks such as current_user_can() before executing post mutations. Code-level references from the plugin's Subversion repository identify the vulnerability at class-advancenavmenumanager.php lines 231 and 236, and option.php line 107, confirmed across both version tags 1.1 and 1.3. The plugin uses the WordPress core function wp_insert_post() to perform nav_menu_item post actions (duplicate, copy, move, publish) without verifying the requesting user's authorization level, violating the principle of least privilege in the WordPress plugin security model.

RemediationAI

No exact patched version number is specified in the available data - patch availability should be independently verified via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e234a79d-5d46-44db-833c-51e202dc49bf and the WordPress plugin repository. Site administrators should update the Advance Nav Menu Manager plugin to the latest available version immediately if a patched release has been published. As a compensating control pending a patch, administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to eliminate the subscriber account attack surface; note this may affect site functionality that relies on user self-registration. Where subscriber accounts exist for legitimate purposes, review whether those users should retain any interaction with navigation management functionality and consider temporarily deactivating the plugin until a fix is confirmed. No workaround can fully remediate the missing authorization check within the plugin code itself without a vendor-supplied patch.