Authorization Bypass Flaw in Quick Restaurant Menu Plugin for WordPress

CVE-2023-0555

Summary

The Quick Restaurant Menu plugin for WordPress is susceptible to an authorization bypass vulnerability due to inadequate capability checks in its AJAX functionality. This flaw allows authenticated users with subscriber-level permissions and above to access privileged actions intended exclusively for administrators, including creating, updating, and deleting menu items. Furthermore, the plugin lacks adequate verification mechanisms for post IDs provided in its AJAX requests, potentially leading to unauthorized deletion or alteration of arbitrary posts. It is essential for users of this plugin to update to the latest version to mitigate these risks and secure their WordPress installations.

References