Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 0.1%
exploitation probability
0.1%top 96% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Clever Mega Menu for Visual Composerpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/23c9232c-73e1-477e-a0b5-bceebb6ab6dd/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.