CVE-2026-125808: WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability

Q: Which installations are affected?

HT Mega for Elementor versions through 3.2.8 are affected. The available information does not identify a lower affected version, so installations reported as any version up to 3.2.8 should be treated as potentially vulnerable.

Q: Can this be exploited remotely without an account?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact if exploited?

The reported impact is limited confidentiality impact, with no stated integrity or availability impact. The vulnerability concerns incorrectly configured access-control security levels.

Published Nov 13, 2026

Updated

Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.

Affected Software

1 affected component

wordpress/ht-mega-for-elementor<=3.2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/ht-mega-for-elementor to a version that resolves this vulnerability.
Fixed in 3.2.9

Event History

Nov 13, 2026

CVE Published

via MITRE·02:37 PM

Data Sourced

via MITRE·02:37 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

HT Mega for Elementor versions through 3.2.8 are affected. The available information does not identify a lower affected version, so installations reported as any version up to 3.2.8 should be treated as potentially vulnerable.

Can this be exploited remotely without an account?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected impact if exploited?

The reported impact is limited confidentiality impact, with no stated integrity or availability impact. The vulnerability concerns incorrectly configured access-control security levels.

CVE-2026-125808: WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without an account?

What is the expected impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without an account?

What is the expected impact if exploited?