CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 5.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings.
Explanation of Vulnerability in Simple Terms
The Food Menu plugin for WooCommerce versions up to 5.1.4 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify menu data or settings they should not have access to. The vulnerability requires an active user account but no special interaction from the victim.
What an attacker can do
Modify restaurant menu data or plugin settings without proper authorization.
Potential impact on your site
Unauthorized users can alter menu items, pricing, or ordering settings, potentially disrupting business operations.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
