Subscriber Broken Access Control in RT Mega Menu for Elementor & Gutenberg
CVE-2026-65433

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Rt Mega Menu – Mega Menu Builder For Elementor & Gutenberg
Vendor
CVE Published:
27 July 2026

What is CVE-2026-65433?

The RT Mega Menu plugin, designed for Elementor and Gutenberg, suffers from a broken access control vulnerability allowing unauthorized users to access restricted subscriber-level features in versions up to 1.5.1. This can lead to potential data exposure and unauthorized modifications, necessitating immediate attention for affected installations to enhance security and protect user data.

Affected Version(s)

RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1

References

https://patchstack.com/database/wordpress/plugin/rt-mega-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

luc | Patchstack Bug Bounty Program
.