CVE-2026-15385 in RT Mega Menu Plugin
Summary
by MITRE • 08/02/2026
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
The RT Mega Menu WordPress plugin vulnerability represents a critical access control flaw that undermines the security model of content management systems. This issue affects versions prior to 1.5.2 and demonstrates how seemingly minor implementation gaps can lead to severe privilege escalation attacks. The vulnerability stems from insufficient capability validation within the AJAX handling mechanism, where the plugin relies solely on a nonce for authentication rather than implementing proper user permission checks. According to CWE-285, this constitutes an inadequate authorization check that allows unauthorized users to perform privileged operations.
The technical exploitation pathway begins with a logged-in subscriber account gaining access to the plugin's AJAX endpoint through reading the nonce from standard admin pages. This nonce-based authentication system fails to verify whether the requesting user possesses sufficient privileges to modify menu configurations. The flaw manifests when a malicious user creates or modifies menu items, storing style attributes that are directly rendered into HTML without proper output escaping. As defined by CWE-1004, this represents a failure to properly sanitize data before incorporating it into dynamic content generation.
The operational impact of this vulnerability extends far beyond simple menu customization, creating a persistent cross-site scripting vector that can compromise all site visitors. When the maliciously crafted style attribute containing JavaScript event handlers executes on navigation hover events, it establishes a session takeover mechanism that affects every visitor including administrators. This attack vector aligns with ATT&CK technique T1059.007 for script injection and T1531 for account access removal, as it enables unauthorized code execution within the context of legitimate user sessions.
The persistence of this attack occurs through the manipulation of menu item attributes that are stored server-side and subsequently rendered without sanitization in public-facing navigation elements. This creates a server-side code injection scenario where JavaScript event handlers become embedded within the site's front-end interface, executing automatically for every visitor who interacts with the navigation menu. Organizations must implement proper input validation and output escaping mechanisms to prevent such vulnerabilities, as outlined in OWASP Top 10 categories and the principle of least privilege enforcement.
Mitigation strategies should include immediate plugin updates to version 1.5.2 or later, which implements proper capability checks and input sanitization. System administrators should also consider implementing additional security measures such as role-based access controls, regular security audits of installed plugins, and monitoring for unauthorized configuration changes. The vulnerability highlights the importance of comprehensive security testing that includes authentication validation and output escaping verification, particularly in web applications where user-generated content can influence system behavior.