Unauthorized Access in Clever Mega Menu Plugin for WordPress
CVE-2026-11872

Currently unrated

Key Information:

Vendor

WordPress
Status
Clever Mega Menu For Visual Composer
Vendor
CVE Published:
2 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-11872?

The Clever Mega Menu for Visual Composer plugin, versions up to 1.0.1, lacks essential nonce verification and capability checks during an AJAX action that updates menu item metadata. This oversight permits any authenticated user, including those with minimal privileges like Subscribers, to alter the public navigation menu items on the website. As a result, unauthorized changes to navigation settings and content become feasible, potentially undermining site integrity and user experience.

Affected Version(s)

Clever Mega Menu for Visual Composer 0 <= 1.0.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-11872 - Proof of Concept

References

https://wpscan.com/vulnerability/23c9232c-73e1-477e-a0b5-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • đź‘ľ

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pablo González and Fran Ramírez
WPScan
.