CVE-2026-11872: CWE-284 Improper Access Control in Clever Mega Menu for Visual Composer
CVE-2026-11872 is a vulnerability in the Clever Mega Menu for Visual Composer WordPress plugin through version 1.0.1. It lacks nonce or capability checks in an AJAX action that updates navigation menu item metadata. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to overwrite menu item content and settings displayed in the site's public navigation.
AI Analysis
Technical Summary
The Clever Mega Menu for Visual Composer plugin versions up to 1.0.1 do not perform proper access control checks (nonce or capability verification) on an AJAX endpoint responsible for updating navigation menu item metadata. As a result, any authenticated user, regardless of their role or permissions, can modify menu items that appear on the public-facing site navigation. This constitutes an improper access control vulnerability classified under CWE-284.
Potential Impact
An attacker with any authenticated user account, including low-privilege Subscriber roles, can alter the site's navigation menu content and settings. This could lead to unauthorized changes in site navigation, potentially misleading users or facilitating further attacks such as phishing or redirecting visitors to malicious sites. The vulnerability compromises the integrity of the site's public navigation elements.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and monitor for unauthorized changes to navigation menus. Avoid granting unnecessary user accounts on the affected WordPress installation.
CVE-2026-11872: CWE-284 Improper Access Control in Clever Mega Menu for Visual Composer
Description
CVE-2026-11872 is a vulnerability in the Clever Mega Menu for Visual Composer WordPress plugin through version 1.0.1. It lacks nonce or capability checks in an AJAX action that updates navigation menu item metadata. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to overwrite menu item content and settings displayed in the site's public navigation.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Clever Mega Menu for Visual Composer plugin versions up to 1.0.1 do not perform proper access control checks (nonce or capability verification) on an AJAX endpoint responsible for updating navigation menu item metadata. As a result, any authenticated user, regardless of their role or permissions, can modify menu items that appear on the public-facing site navigation. This constitutes an improper access control vulnerability classified under CWE-284.
Potential Impact
An attacker with any authenticated user account, including low-privilege Subscriber roles, can alter the site's navigation menu content and settings. This could lead to unauthorized changes in site navigation, potentially misleading users or facilitating further attacks such as phishing or redirecting visitors to malicious sites. The vulnerability compromises the integrity of the site's public navigation elements.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and monitor for unauthorized changes to navigation menus. Avoid granting unnecessary user accounts on the affected WordPress installation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-10T12:22:23.523Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6f99c8bf32cb7a344bd97f
Added to database: 08/02/2026, 19:26:00 UTC
Last enriched: 08/02/2026, 19:26:29 UTC
Last updated: 08/02/2026, 21:31:56 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.