blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-11872

MEDIUM 4.3 CVSS 3.1
Published
August 2, 2026
Last modified
August 26, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-284
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.

Affected products and versions

  • Unknown Clever Mega Menu for Visual Composer — Up to and including 1.0.1

References

  • wpscan.com https://wpscan.com/vulnerability/23c9232c-73e1-477e-a0b5-bceebb6ab6dd/
  • nvd.nist.gov Official NVD record