CVE-2026-84935 in HT Menu Plugin
Summary
by MITRE • 09/05/2026
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in HT Menu versions prior to 1.2.7 represents a critical intersection of authorization bypass and cross-site scripting flaws within the WordPress ecosystem. This specific plugin manages navigation menus for websites built on the WordPress platform, which is one of the most widely used content management systems globally. The core issue stems from insufficient access control mechanisms during the data persistence phase combined with inadequate output encoding during the rendering phase. These two distinct technical failures create a chain reaction that allows attackers to execute arbitrary JavaScript code in the context of any user viewing the affected menu, including high-privilege administrators. This scenario is particularly dangerous because it leverages low-level permissions to achieve high-impact outcomes, effectively bypassing the principle of least privilege inherent in WordPress role-based access control systems.
From a technical perspective, the first flaw involves an authorization failure where the plugin fails to verify whether the user initiating the save operation has the necessary capabilities or ownership over the specific menu item being modified. In standard WordPress architecture, actions such as editing navigation menus are typically restricted to users with elevated privileges like Editors or Administrators due to the potential for site structure manipulation and security risks. However, HT Menu before version 1.2.7 does not enforce these checks when processing requests to save navigation menu-item settings. Consequently, a user authenticated with the lowest possible privilege level, such as a Subscriber, can successfully submit data that alters the configuration of the website's navigation elements. This lack of object-ownership verification means there is no validation ensuring that the requesting user has legitimate rights to modify the specific resource they are targeting, allowing unauthorized writes to critical site components.
The second technical flaw lies in the handling and rendering of the stored settings. Once the malicious data is successfully saved due to the authorization bypass, it is not properly escaped when the menu is rendered on the frontend or backend interface. This absence of output encoding means that any JavaScript code embedded within the menu item configuration will be interpreted by the browser as executable script rather than plain text. When a visitor loads a page containing this compromised navigation menu, their browser parses and executes the injected scripts in the context of the website's domain. This behavior is characteristic of stored cross-site scripting vulnerabilities where malicious payloads are persistently stored on the server and delivered to victims upon request. The persistence aspect ensures that every user who views the affected menu becomes a potential victim until the vulnerability is patched or the data is manually cleaned from the database.
The operational impact of this vulnerability extends beyond simple defacement or session hijacking, although those remain significant risks. An attacker with Subscriber-level access can escalate their influence across the entire site by targeting administrators. By crafting a payload that performs actions such as stealing administrative cookies, capturing authentication tokens, or executing commands via AJAX requests to WordPress endpoints, an attacker can gain full control over the website. This is particularly severe because it allows privilege escalation from a low-privilege account to complete system compromise without requiring any additional exploits or social engineering tactics beyond convincing a user with minimal permissions to create malicious menu items. The attack vector is straightforward and does not require complex exploitation techniques, making it highly feasible for automated scanning tools and opportunistic attackers targeting WordPress installations running this plugin version.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-862 Missing Authorization, which describes the failure to enforce proper access controls on resources or functions. Additionally, the lack of output encoding places it firmly within CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting XSS. The exploitation technique maps directly to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing arbitrary code via JavaScript injection, and potentially T1534 Internal Spearphishing if the attack is directed at specific administrators within an organization. These mappings highlight the severity of the issue from both a defensive monitoring perspective and a vulnerability management standpoint.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary and most effective solution is to upgrade the HT Menu plugin to version 1.2.7 or later, where these authorization checks and output escaping mechanisms have been implemented by the developers. For organizations unable to patch immediately due to compatibility concerns with other plugins or themes, temporary workarounds should be considered. These may include restricting Subscriber-level access entirely if not required for business operations, implementing a Web Application Firewall rule that detects and blocks XSS payloads in menu-related POST requests, or manually auditing existing menu items for suspicious script tags. Regular security audits of custom code and third-party plugins are essential to prevent similar authorization bypasses and input validation failures from occurring in other parts of the application stack.