WordPress Plugin Vulnerabilities

Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item

Description

The plugin does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.

Proof of Concept

Affects Plugins

Plugin icon
clever-mega-menu
No known fix

References

CVE
CVE-2026-11872

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Pablo González and Fran Ramírez
Submitter
Pablo González and Fran Ramírez
Verified
Yes
WPVDB ID
23c9232c-73e1-477e-a0b5-bceebb6ab6dd

Timeline

Publicly Published
2026-07-21 (about 12 days ago)
Added
2026-07-21 (about 11 days ago)
Last Updated
2026-07-21 (about 11 days ago)

Other

Published
Title
Published
2024-01-24
Title
Views for WPForms < 3.2.3 - Missing Authorization via create_view
Published
2021-10-26
Title
HashThemes Demo Importer < 1.1.2 - Improper Access Control to Blog Reset
Published
2026-08-05
Title
Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment
Published
2021-04-30
Title
Download Manager < 3.1.23 - Unauthorised Asset Manager Usage
Published
2026-01-19
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 4.2.5 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure