Authorization Flaw in Food Menu Plugin Exposes Reservation Status to Unauthenticated Users
CVE-2026-13328
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13328?
The Food Menu plugin for WordPress prior to version 6.0.2 has a significant vulnerability that allows unauthenticated users to modify reservation statuses. This issue arises from the lack of proper capability and ownership checks in the reservation-status update action. The action is accessible to any visitor through a nonce that can be easily obtained, enabling attackers to manipulate reservation data without authorization. Website owners should ensure they update to the latest version to mitigate this risk.
Affected Version(s)
Food Menu 0 < 6.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.