EUVD-2026-16171
GHSA-qhrq-phcx-qjv3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a low-to-moderate severity that aligns with the real-world risk profile. The attack vector is network-accessible with low complexity, but critically requires user interaction (UI:R)-an administrator must click a malicious link. The impact is limited to integrity (I:L) with no confidentiality or availability compromise; an attacker can only modify menu assignments, not access sensitive data or disable the site. CISA's SSVC framework corroborates this assessment: exploitation status is 'none' (no active exploitation detected), the attack is not automatable (requires social engineering), and technical impact is only partial. The absence of any KEV (Known Exploited Vulnerability) status and lack of public POC further reduce urgency. This is a legitimate WordPress security concern requiring patching but does not warrant immediate emergency response compared to unauthenticated remote code execution or authentication bypass vulnerabilities. |
| Exploit ScenarioDerived | An attacker emails a WordPress site administrator a seemingly benign link (e.g., disguised as a support ticket or software update notification). When the admin clicks the link while logged into WordPress, the attacker's page issues an invisible HTTP request to the WordPress site using the admin's authenticated session. Because the save_options function lacks nonce validation, the request succeeds, and the attacker remotely reconfigures which menus are displayed under which conditional rules-for example, hiding critical navigation or injecting malicious menu items. The admin never sees a confirmation dialog and is unaware the change occurred until users report missing menus or unexpected content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Unauthenticated attackers can modify conditional menu assignments in the Conditional Menus WordPress plugin (versions up to 1.2.6) through cross-site request forgery attacks by exploiting missing nonce validation in the save_options function. An attacker can trick site administrators into clicking a malicious link to alter menu configurations without their knowledge. No patch is currently available for this vulnerability.
Earlier versions of this analysis (1)
Conditional Menus plugin for WordPress up to version 1.2.6 fails to validate nonce tokens on the save_options function, enabling unauthenticated attackers to modify conditional menu assignments through Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when clicked by an authenticated WordPress administrator, silently changes menu configurations without their knowledge or consent. No public exploit code or active exploitation has been confirmed at the time of analysis.
RemediationAI
Upgrade Conditional Menus to a version newer than 1.2.6, which should include nonce validation in the save_options function as evidenced by the upstream fix in changeset 3463814 at https://plugins.trac.wordpress.org/changeset/3463814/. If an immediate update is not available, restrict WordPress admin access to trusted IP addresses using a Web Application Firewall (WAF) or network-level rules, and educate administrators to avoid clicking links from untrusted sources while logged into WordPress. Implement Content Security Policy (CSP) headers to mitigate some CSRF attack vectors, though this is not a complete substitute for nonce validation. Monitor the official WordPress plugin repository and Wordfence for patch availability notices.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Conditional Menus WordPress plugin (CPE: cpe:2.3:a:themifyme:conditional_menus:*:*:*:*:*:*:*:*) is vulnerable due to the absence of nonce validation in its save_options function, which handles menu configuration updates. This is a classic instantiation of CWE-352 (Cross-Site Request Forgery), where a state-changing operation lacks the cryptographic token-based CSRF protections that WordPress provides through its nonce mechanism. The vulnerability exists in the init.php file at lines 183-190, as confirmed by the WordPress plugin repository code browser and changeset 3463814. WordPress nonces are intended to prevent this exact attack class by requiring a time-limited, user-specific token that cannot be forged by an attacker controlling only a victim's browser context.
Know when Conditional Menus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Conditional Menus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.6. This is due to missing nonce validation on the 'save_options' function. This makes it possible for unauthenticated attackers to modify conditional menu assignments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Executive ViewAI
Organizations using for WordPress is vulnerable to Cross-Site Request Forgery in all should be aware of moderate risk from CVE-2026-1032, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement SameSite cookie attributes and anti-CSRF tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Exploit-DB