The vulnerable version of the WordPress Mega Menu – QuadMenu plugin lacks proper nonce validation in its ajax_dismiss_notice handler. Because unauthenticated users can call this endpoint with a forged request, they can set any user meta field to the value one. When the wp_capabilities meta is updated, an administrator’s role can be downgraded, effectively removing administrative rights and compromising site security. This constitutes a privilege deescalation flaw that can be exploited only after convincing a legitimate administrator to perform a specific action such as clicking a malicious link.

The affected product is QuadMenu – Mega Menu from quadlayers, in all releases up to and including version 3.2.0. Upgrade to 3.2.1 or later is required to eliminate the flaw.

The CVSS score of 4.3 and an EPSS below 1% indicate a low severity but also a very small chance that the attack will be observed in the wild. With no listing in the CISA KEV catalog, the vulnerability is not known to be actively exploited. An attacker can still use social engineering to trick an administrator into executing the forged Ajax call, but the overall risk remains modest compared to higher‑impact flaws.