CVE-2026-8688: CWE-862 Missing Authorization in krishaweb Advance Nav Menu Manager
The Advance Nav Menu Manager WordPress plugin up to version 1.3 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can perform unauthorized actions such as duplicating, copying, moving, or publishing navigation menu items. This occurs because the plugin does not properly verify user authorization before allowing modifications to nav_menu_item posts.
AI Analysis
Technical Summary
CVE-2026-8688 is an authorization bypass vulnerability (CWE-862) in the Advance Nav Menu Manager plugin for WordPress. The flaw exists in all versions up to and including 1.3, where the plugin fails to properly check that a user is authorized to perform certain actions on navigation menu items. As a result, authenticated users with low privileges (subscriber-level and above) can manipulate nav_menu_item posts via wp_insert_post(), enabling unauthorized duplication, copying, moving, or publishing of menu items, potentially altering site navigation without proper permission.
Potential Impact
The vulnerability allows authenticated users with minimal privileges to modify navigation menus without authorization. This can lead to unauthorized changes in site navigation structure, potentially causing user confusion or facilitating further attacks that rely on manipulated menus. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only or disable the plugin if unauthorized menu modifications pose a risk.
CVE-2026-8688: CWE-862 Missing Authorization in krishaweb Advance Nav Menu Manager
Description
The Advance Nav Menu Manager WordPress plugin up to version 1.3 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can perform unauthorized actions such as duplicating, copying, moving, or publishing navigation menu items. This occurs because the plugin does not properly verify user authorization before allowing modifications to nav_menu_item posts.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-8688 is an authorization bypass vulnerability (CWE-862) in the Advance Nav Menu Manager plugin for WordPress. The flaw exists in all versions up to and including 1.3, where the plugin fails to properly check that a user is authorized to perform certain actions on navigation menu items. As a result, authenticated users with low privileges (subscriber-level and above) can manipulate nav_menu_item posts via wp_insert_post(), enabling unauthorized duplication, copying, moving, or publishing of menu items, potentially altering site navigation without proper permission.
Potential Impact
The vulnerability allows authenticated users with minimal privileges to modify navigation menus without authorization. This can lead to unauthorized changes in site navigation structure, potentially causing user confusion or facilitating further attacks that rely on manipulated menus. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only or disable the plugin if unauthorized menu modifications pose a risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-15T14:37:32.505Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3b7812eed863c81e5f72ce
Added to database: 06/24/2026, 06:24:18 UTC
Last enriched: 06/24/2026, 06:41:47 UTC
Last updated: 06/24/2026, 07:40:30 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.