CyberRota Analysis
AI-GeneratedThe RT Mega Menu WordPress plugin prior to version 1.5.2 is vulnerable due to inadequate capability checks on AJAX actions, allowing any logged-in user, including those with subscriber-level access, to manipulate menu configurations. This vulnerability can lead to the injection of malicious JavaScript into the public navigation, potentially resulting in session hijacking or site takeover for all visitors, including administrators. WordPress site administrators and developers using this plugin should prioritize immediate updates to mitigate this risk.
Original NVD Description
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.