CVE-2026-32456: 
WordPress vulnerability analysis and mitigation

CVE-2026-32456 is a Cross-Site Request Forgery (CSRF) vulnerability in the Admin Menu Editor WordPress plugin developed by Janis Elsts. It affects all versions of the plugin up to and including 1.14.1, allowing unauthenticated attackers to perform unauthorized actions on behalf of authenticated users through social engineering. The vulnerability was published on March 13, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), stemming from insufficient or absent CSRF token validation in the Admin Menu Editor plugin's request handling. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator, silently submits a forged request to modify the admin menu configuration without the user's explicit consent. Exploitation requires user interaction — specifically, a logged-in administrator must be tricked into visiting an attacker-controlled page. No authentication or elevated privileges are required on the attacker's side (Feedly, Patchstack).

Successful exploitation allows an attacker to modify WordPress admin menu configurations without the administrator's knowledge or consent, resulting in a low integrity impact with no confidentiality or availability impact. While the direct impact is limited, manipulation of admin menus could be used to hide malicious activity, redirect administrators to attacker-controlled pages, or disrupt normal site management workflows. The scope is unchanged, meaning the impact is confined to the vulnerable WordPress installation (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is extremely low at 0.000080, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick an authenticated administrator into visiting a malicious page (Feedly).

1. Reconnaissance: Identify a target WordPress site running Admin Menu Editor plugin version 1.14.1 or earlier, which can be detected via plugin enumeration techniques or public WordPress plugin metadata.
2. Craft malicious payload: Create an HTML page containing a hidden form that submits a forged POST request to the target WordPress site's admin endpoint responsible for saving Admin Menu Editor settings (e.g., wp-admin/options-general.php?page=menu_editor).
3. Social engineering: Deliver the malicious page link to a logged-in WordPress administrator via phishing email, forum post, or other communication channel.
4. Trigger forged request: When the administrator visits the attacker's page, the hidden form auto-submits, sending the forged request with the administrator's session cookies, causing unauthorized modification of the admin menu configuration.
5. Achieve objective: The admin menu is altered according to the attacker's payload — for example, hiding security-related menu items or injecting misleading links — without the administrator's awareness (Feedly).

• Logs: WordPress access logs showing unexpected POST requests to wp-admin/options-general.php?page=menu_editor or similar Admin Menu Editor endpoints from unusual referrer URLs or external domains.
• File System: Unexpected changes to Admin Menu Editor configuration stored in the WordPress database (wp_options table, option name related to admin-menu-editor) without corresponding administrator activity.
• Logs: WordPress audit logs (if enabled via a logging plugin) recording admin menu configuration changes at unusual times or without a corresponding admin login session from a known IP address.

Users should update the Admin Menu Editor plugin to a version beyond 1.14.1, which addresses the CSRF vulnerability. Until a patch is applied, administrators should exercise caution when clicking links from untrusted sources while logged into WordPress, and consider using browser extensions or security plugins that block cross-site request forgery attempts. Implementing a Web Application Firewall (WAF) with CSRF protection rules can also provide an additional layer of defense (Patchstack, Feedly).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the week of March 9–15, 2026, as part of routine plugin vulnerability tracking (Wordfence). It was also noted on Bluesky via automated CVE tracking accounts and indexed by several vulnerability aggregation platforms including VulDB and CVEFeed shortly after disclosure. No significant researcher commentary or vendor statements beyond the Patchstack advisory have been observed.