What is GHSA-m349-rc55-q5w8?

GHSA-m349-rc55-q5w8 is a security advisory published by GitHub Security Advisories with Medium severity. The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce...

Which CVE IDs does GHSA-m349-rc55-q5w8 cover?

GHSA-m349-rc55-q5w8 covers the following CVE IDs: CVE-2026-11872. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m349-rc55-q5w8?

GHSA-m349-rc55-q5w8 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-m349-rc55-q5w8MediumCVSS 4.3

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce...

Vendor

GitHub Security Advisories

Published

August 2, 2026

Last Modified

August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-11872 →

📋 Description

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-11872
https://wpscan.com/vulnerability/23c9232c-73e1-477e-a0b5-bceebb6ab6dd
https://github.com/advisories/GHSA-m349-rc55-q5w8