Vulnerability · Published Aug 2, 2026 · Assigned by WPScan
CVE-2026-11872Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item
Medium 4.3
In plain English
A medium-severity improper access control in Clever Mega Menu for Visual Composer from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 82.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Clever Mega Menu for Visual Composer | 0 – through 1.0.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/23c9232c-73e1-477e-a0b5-bceebb6ab6dd/ exploit, vdb-entry, technical-description