CVE-2026-13328

None

Open

TLP:CLEAR

TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.

Details

EPSS Score ⓘ: 0.15%

4.6th percentile
Confidence: 90%
Published: Aug 13, 2026
Last Modified: Aug 13, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.