CVE-2025-24692

Vulnerability

The Bulk Menu Edit plugin for WordPress (versions through 1.3) contains a missing authorization vulnerability. The plugin fails to perform capability checks for menu operations, allowing any authenticated user to modify menu items without proper permissions. This affects versions from n/a through 1.3 as specified in the CVE description [1].

Exploitation

An attacker with any level of WordPress authentication (e.g., subscriber) can exploit this by sending crafted requests to the plugin's AJAX handlers, which lack nonce verification and capability checks in affected versions. The attacker can manipulate menu items via the plugin's functionality without needing administrator privileges [1].

Impact

Successful exploitation allows an attacker to arbitrarily add, remove, or modify menu items, potentially redirecting users to malicious sites or disrupting site navigation. This compromises the integrity of the WordPress site and could be used for phishing or defacement attacks [1].

Mitigation

The vulnerability is fixed in version 1.3.1 of the Bulk Menu Edit plugin, released on 2025-01-21. Users should update to version 1.3.1 or later immediately. The changelog confirms that capability checks and nonce verification were added to address this issue [1].