CVE-2026-1032 describes a CSRF vulnerability in the themifyme Conditional Menus WordPress plugin versions up to 1.2.6. The issue arises because the 'save_options' function lacks nonce validation, which is a security mechanism to verify the legitimacy of requests. As a result, an attacker can craft a malicious request that, if executed by an authenticated administrator (e.g., by clicking a link), can alter menu assignments without proper authorization. This vulnerability does not impact confidentiality or availability but allows limited unauthorized modification of plugin settings.

An attacker can cause an authenticated administrator to unknowingly modify conditional menu assignments via a forged request. This could lead to unauthorized changes in the website's menu configuration, potentially affecting site navigation or user experience. There is no indication of data disclosure or system compromise beyond the integrity impact on menu settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider limiting administrative access. Implementing additional CSRF protections or nonce validation in the plugin code can mitigate this vulnerability.