CVE-2026-15385 RT Mega Menu CVE debrief

Who should care

Administrators and users of the RT Mega Menu WordPress plugin, as well as users of WordPress sites with the plugin installed, should be aware of this vulnerability and take steps to mitigate it. They should review their plugin versions, assess their exposure, and implement necessary controls to prevent exploitation.

Technical summary

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings. Its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. This allows for the persistence of a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, potentially leading to session or site takeover.

Defensive priority

Administrators and users of the RT Mega Menu WordPress plugin should prioritize updating to version 1.5.2 or later to address the vulnerability.

Recommended defensive actions

• Update RT Mega Menu WordPress plugin to version 1.5.2 or later
• Restrict access to mega menu configuration and per-menu-item settings
• Implement output escaping for style attributes in navigation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the RT Mega Menu WordPress plugin before version 1.5.2. A subscriber-level user can exploit this by enabling the mega menu and storing a malicious style value. The value is rendered without output escaping, allowing for the injection of a JavaScript event handler. To verify, defenders should review the plugin version, check for suspicious mega menu configurations, and monitor for unusual navigation behavior.

Official resources