CVE-2026-11872CWE-284broken-access-control

CVE-2026-11872

Medium · published August 2, 2026

CVSS v3.1

4.3

EPSS

Percentile

16.0

In the wild

Unconfirmed

What it is

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00254 · 16.0th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2026-08-02T10:16Z

References (1)

https://wpscan.com/vulnerability/23c9232c-73e1-477e-a0b5-bceebb6ab6dd/ · [email protected]

EPSS history

Timeline

02 AUG 06:00Z
Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item
cvelistv5