This vulnerability is a broken access control issue in the RT Mega Menu plugin for Elementor & Gutenberg, identified as CWE-862. It affects versions up to and including 1.5.1, allowing subscriber-level users to perform unauthorized actions that compromise data integrity. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and no user interaction required. There is no confidentiality or availability impact, but integrity is impacted. No official patch or remediation guidance is currently available from the vendor or advisory sources.

The vulnerability allows attackers with subscriber privileges to bypass authorization controls and perform unauthorized modifications, impacting the integrity of the affected system. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for suspicious activity related to menu management. Avoid granting unnecessary permissions to subscriber roles.