Executive Summary
CVE-2026-85683 affects the Jane Menu WordPress plugin in all versions before 1.5.1. One of its form handlers has no capability check and no nonce check, and it can be reached by unauthenticated users. An attacker can use it to bind any published page to a remote document of their choosing; the plugin then fetches that document. NVD published the entry on October 21, 2026 with a CVSS score of 8.8.
Note: this summary is based on the NVD description as received in our feed, which was truncated, so the exact way the fetched document is output is not described here. Check the NVD entry for the full text.
CVSS Score: 8.8 (High)
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-85683 |
| CVSS Score | 8.8 (High) |
| Affected Software | Jane Menu WordPress plugin, versions before 1.5.1 |
| Fixed Version | 1.5.1 |
| Authentication Required | None (unauthenticated) |
| Root Cause | Missing capability and nonce checks on a form handler |
| Published | October 21, 2026 |
Impact
Because the handler accepts requests from anyone, a remote attacker can change what a published page of the site is tied to, pointing it at content they control. Depending on how the plugin renders the fetched document, this could be used to alter what visitors see on trusted pages of the affected site. The plugin also makes a server-side request for the attacker-chosen document.
Remediation
- Update Jane Menu to version 1.5.1 or later.
- If you cannot update immediately, deactivate the plugin until you can.
- Review published pages for unexpected bindings to remote documents or content you did not add.
- Review web server logs for unauthenticated POST requests to the plugin's form handler.
- Restrict outbound requests from the web server where practical, to limit server-side fetches to attacker-chosen hosts.