This vulnerability in Max Mega Menu is classified as CWE-862, Missing Authorization. It affects versions up to 3.3 and allows an attacker with low privileges to bypass authorization controls, potentially leading to unauthorized information disclosure or modification. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and low impact on confidentiality and integrity with no impact on availability. No patch or official remediation has been disclosed by the vendor as of the publication date.

The vulnerability allows an attacker with limited privileges to bypass authorization checks, which could lead to unauthorized access or modification of data within the Max Mega Menu plugin. The impact is limited to confidentiality and integrity with no availability impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation steps have been provided by the vendor at this time.