CVE-2026-13328
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Food Menu WordPress plugin before version 6.0.2 does not perform any capability or ownership check on its reservation-status update action. This action is exposed to unauthenticated users and protected only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
Risk Assessment
The risk is that unauthorized individuals can manipulate reservations, potentially disrupting restaurant operations, eroding customer trust, and causing operational issues.
Recommendation
Immediately update the Food Menu plugin to version 6.0.2 or later, which includes a security fix. Additionally, restrict access to the admin panel and monitor logs for unauthorized changes.
Original NVD description (English source)
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.