PT-2026-28310 · WordPress · Conditional Menus

Daniel Basta · Publicado 2026-03-26 · Atualizado 2026-03-29 · CVE-2026-1032

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Conditional Menus for WordPress versions prior to 1.2.7

Description The Conditional Menus plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.2.6. The issue stems from the absence of nonce validation within the save options function. This allows unauthenticated attackers to potentially modify conditional menu assignments through a forged request, provided they can trick a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Conditional Menus plugin to version 1.2.7 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-1032

Produtos afetados

Conditional Menus

Referências · 7

• https://twitter.com/cyberbivash/status/2037191239737450871 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/conditional-menus/tags/1.2.6/init.php#L183 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1032 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/conditional-menus/tags/1.2.6/init.php#L190 · Nota
• https://twitter.com/CVEnew/status/2038135194545487922 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3463814 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/7f4cf85d-6105-4f7d-b4a0-18a3513a93a8?source=cve · Nota