The vulnerability is a broken access control flaw in the RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin versions 1.5.1 or earlier. As described, a WordPress user with a Subscriber role can trigger administrative functions that are normally restricted to higher‑privileged users. The exact scope of the unauthorized actions is not detailed in the CVE, but any privileged capability granted by the plugin could potentially be abused, indicating a risk of privilege escalation within the site’s administrative interface.

WordPress sites that have installed the themewant RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin version 1.5.1 or earlier are affected. The vulnerability remains regardless of the site’s configuration or the existence of additional addons.

The CVSS score of 6.5 labels the risk as Moderate, while the EPSS score of <1% indicates a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the vulnerability by accessing the plugin’s administrative endpoints with any subscriber account; from the description, it appears the necessary conditions are simply the presence of a subscriber authenticated user on the target WordPress installation.