CVE-2026-11872: Clever Mega Menu Auth Bypass Vulnerability

CVE-2026-11872 Overview

CVE-2026-11872 is a broken access control vulnerability [CWE-284] in the Clever Mega Menu for Visual Composer WordPress plugin through version 1.0.1. The plugin exposes an AJAX action that updates navigation menu item metadata without performing a nonce or capability check. Any authenticated user, including low-privilege Subscribers, can invoke the action to overwrite menu item content and settings rendered in the site's public navigation. Attackers can leverage this flaw to alter navigation links, inject unauthorized content, or redirect visitors to attacker-controlled destinations.

Critical Impact
Authenticated users with Subscriber-level access can tamper with public site navigation, enabling content manipulation and potential redirection attacks against site visitors.

Affected Products

Clever Mega Menu for Visual Composer WordPress plugin, all versions through 1.0.1
WordPress sites running Visual Composer with the affected plugin installed
Any deployment permitting Subscriber-level or higher user registration

Discovery Timeline

2026-08-02 - CVE-2026-11872 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-11872

Vulnerability Analysis

The vulnerability resides in an AJAX handler exposed by the Clever Mega Menu for Visual Composer plugin. The handler updates WordPress navigation menu item metadata but omits two required WordPress security checks: nonce verification through check_ajax_referer() and capability verification through current_user_can(). WordPress registers AJAX actions under wp_ajax_{action} for authenticated users, meaning any logged-in user, regardless of role, can invoke the endpoint.

Because navigation menus are rendered site-wide, tampered menu items appear in the public navigation surfaced to every visitor. An attacker abusing this endpoint can replace legitimate menu labels, URLs, or associated settings with attacker-controlled values. The resulting integrity impact on public-facing content is the primary risk vector reflected in the CVSS assessment.

Root Cause

The root cause is broken access control [CWE-284]. The AJAX action handler treats authentication as sufficient authorization, skipping both intent verification (nonce) and role-based permission checks. WordPress documentation requires developers to gate administrative AJAX endpoints behind capability checks such as edit_theme_options or manage_options, neither of which is enforced here.

Attack Vector

Exploitation requires only a valid authenticated WordPress session at Subscriber level or above. The attacker sends a crafted POST request to admin-ajax.php specifying the vulnerable action and the target menu item metadata. No user interaction from an administrator is needed, and the request completes over the network against the site's standard WordPress endpoints.

No verified public proof-of-concept code has been published. Technical details are documented in the WPScan Vulnerability Notice.

Detection Methods for CVE-2026-11872

Indicators of Compromise

Unexpected modifications to WordPress navigation menu items, including changed labels, URLs, or CSS classes not attributable to administrator actions
POST requests to /wp-admin/admin-ajax.php originating from low-privilege user sessions targeting the plugin's menu update action
New or unusual entries in the wp_postmeta table for nav_menu_item post types

Detection Strategies

Review WordPress audit logs for menu item edits performed by users lacking the edit_theme_options capability
Correlate admin-ajax.php traffic with the requesting user's role to flag privilege mismatches
Baseline navigation menu contents and alert on drift between authorized deployments and live values

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture menu changes with user attribution
Forward web server access logs to a centralized SIEM and alert on repeated AJAX action calls from Subscriber accounts
Monitor outbound clicks and referrer patterns from navigation elements for signs of malicious redirection

How to Mitigate CVE-2026-11872

Immediate Actions Required

Deactivate the Clever Mega Menu for Visual Composer plugin until a patched release is available
Audit existing WordPress user accounts and remove or downgrade Subscriber accounts that are not required
Review current navigation menu items and restore any values that appear to have been altered

Patch Information

At the time of publication, no vendor-supplied fix is listed in the NVD entry for versions after 1.0.1. Administrators should monitor the WPScan Vulnerability Notice and the plugin's WordPress.org listing for an updated release addressing the missing nonce and capability checks.

Workarounds

Disable open user registration in WordPress settings to prevent unauthenticated attackers from obtaining Subscriber accounts
Restrict access to /wp-admin/admin-ajax.php at the web application firewall by rejecting the vulnerable action name for non-privileged sessions
Remove the plugin entirely if navigation menu functionality can be provided by an alternate, maintained plugin

bash

# Example WAF rule concept: block the vulnerable AJAX action for low-privilege sessions
# Adjust action name once confirmed in the plugin source
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1102026,msg:'Block Clever Mega Menu vulnerable AJAX action'"
  SecRule ARGS:action "@rx ^clever_mega_menu_" "t:lowercase"