You need to make sure that the script has writable access to the xoops cache folder, this is where the mainmenu file is stored and written.

That error message is generated if:

1) The request method is not POST; or
2) The HTTP_REFERER check fails; or
3) The file cache/adminmenu.php cannot be written to.

Solutions:

1) The request method is not POST.

This is a security check. This should never occur with the standard XOOPS code. It could result from faulty third-party code.

2) The HTTP_REFERER check fails.

This is another security check. It means that that the client (browser, firewall, popup blocker, etc) is blocking the HTTP_REFERER header from being sent.

3) The file cache/adminmenu.php cannot be written to.

Ensure that the cache directory and the file cache/adminmenu.php are writable. The file cache/adminmenu.php may be safely deleted.