The VM Menu Reorder plugin contains a missing or incorrect nonce validation in the vm_set_to_default function, allowing an attacker to forge a request that resets all menu reordering settings. The vulnerability can be leveraged by any unauthenticated user who tricks an administrator into visiting a crafted link, resulting in the administrator’s menu configuration being overwritten. This flaw corresponds to CWE‑352 and enables attackers to alter the site’s navigation structure, potentially disrupting user experience and facilitating further malicious activity.

WordPress sites that have the VM Menu Reorder plugin installed with version 1.0.0 or earlier are affected. The issue resides in the plugin’s core code, and all administrators who use the default menu reordering functionality are at risk.

The CVSS score of 4.3 reflects a moderate impact. The EPSS score of less than 1% indicates a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires an administrator to be authenticated and to click a maliciously crafted link; no direct server‑side access is needed. Because the attacker can force a configuration reset, the risk is directed at administrative confidentiality and integrity rather than system compromise.