medium5.3
CVE-2026-13328
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed t…
Impact
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
Affected products
| Product | Affected versions |
|---|---|
| Food Menu WordPress Plugin | before 6.0.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.