Authorization Bypass in Restaurant Menu – Food Ordering System Plugin for WordPress

CVE-2022-2696

What is CVE-2022-2696?

The Restaurant Menu – Food Ordering System plugin for WordPress suffers from an authorization bypass vulnerability. This issue arises from the absence of necessary capability checks and nonce validation across several AJAX actions. As a result, authenticated users with limited permissions can exploit this flaw to execute unauthorized actions, including altering plugin settings and adjusting the ordering system preferences. Users of versions up to and including 2.3.0 should take immediate steps to update to the latest version to mitigate these risks.

References