CVE-2024-8434 describes a missing authorization vulnerability in the Easy Mega Menu plugin for WordPress by ThemeHunk. Several AJAX-hooked functions do not perform capability checks, allowing authenticated users with low privileges (subscriber-level and above) to perform unauthorized actions such as modifying plugin settings. This issue affects all versions up to and including 1.0.9. The vulnerability is classified under CWE-862 and has a CVSS 3.1 base score of 4.3 (medium severity). No patch or official fix has been documented in the provided data.

An attacker with subscriber-level access or higher can exploit this vulnerability to update plugin settings without proper authorization. While this does not directly impact confidentiality or availability, it compromises the integrity of the plugin configuration, potentially leading to further security issues or misconfigurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor plugin settings for unauthorized changes. Avoid granting unnecessary privileges to low-level authenticated users.