Unauthorized Access to Plugin Settings Due to Missing Capability Check

CVE-2024-8434

Summary

The Easy Mega Menu Plugin for WordPress, developed by ThemeHunk, has a vulnerability that allows unauthorized access due to inadequate capability checks on several AJAX functions. This flaw affects all versions up to and including 1.0.9, enabling authenticated users, including those with subscriber-level access or above, to exploit the vulnerability and modify plugin settings without proper permissions.

References