The Conditional Menus plugin for WordPress suffers from a missing nonce validation in its save_options function. This flaw permits an unauthenticated attacker to forge a request that will change the assignment of conditional menus when a site administrator is tricked into clicking a malicious link. The resulting impact is unauthorized modification of menu structures, which can confuse users or redirect traffic to unintended destinations, compromising the site’s navigation integrity.

WordPress sites using the Conditional Menus plugin by themifyme, versions up to and including 1.2.6 are vulnerable. No other product or version is listed as affected.

The CVSS score of 4.3 indicates moderate severity. Exploitation requires a social‑engineering precondition—an administrator clicking a crafted URL—so it is not a remote code execution but depends on user interaction. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, suggesting limited known exploitation activity at present. Nonetheless, the described attack vector remains actionable and should be treated with caution.