CVE-2025-2871 is a CSRF vulnerability in the QuadMenu – Mega Menu WordPress plugin affecting all versions up to 3.2.0. The issue arises from missing or incorrect nonce validation on the ajax_dismiss_notice() AJAX function. An attacker can exploit this by crafting a forged request that, when executed by an authenticated administrator (e.g., clicking a malicious link), updates arbitrary user meta fields such as wp_capabilities. This can lead to privilege deescalation of the administrator account. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with no confidentiality or availability impact, but limited integrity impact. No patch or remediation details are currently available from the vendor.

An attacker can cause an authenticated administrator to unknowingly perform actions that update user meta data, including wp_capabilities, which may result in privilege deescalation of the administrator account. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links or performing actions from untrusted sources that could trigger the vulnerable ajax_dismiss_notice() function. Monitoring vendor channels for updates is recommended.