Clever Mega Menu For Visual Composer
Monthly
Clever Mega Menu for Visual Composer (WordPress plugin, versions through 1.0.1) allows any authenticated user with as little as Subscriber-level access to overwrite navigation menu item content and settings through an unprotected AJAX endpoint. The plugin fails to perform either a nonce check or a capability check before processing menu item metadata updates, meaning WordPress role-based access control over menu management is completely bypassed. A publicly available exploit exists via WPScan, though EPSS places exploitation probability at 0.14% (4th percentile) with no CISA KEV listing, indicating limited observed exploitation at time of analysis.
Clever Mega Menu for Visual Composer (WordPress plugin, versions through 1.0.1) allows any authenticated user with as little as Subscriber-level access to overwrite navigation menu item content and settings through an unprotected AJAX endpoint. The plugin fails to perform either a nonce check or a capability check before processing menu item metadata updates, meaning WordPress role-based access control over menu management is completely bypassed. A publicly available exploit exists via WPScan, though EPSS places exploitation probability at 0.14% (4th percentile) with no CISA KEV listing, indicating limited observed exploitation at time of analysis.