CVE-2026-125431: WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.7 - Broken Access Control vulnerability

Q: Which installations are affected?

The affected component is the Food Menu – Restaurant Menu & Online Ordering for WooCommerce WordPress plugin, with versions through 6.0.7 identified as affected. The available data does not specify a lower affected version.

Q: Does exploitation require authentication or user interaction?

No. The provided CVSS vector indicates that the issue is remotely exploitable with low attack complexity and requires neither privileges nor user interaction.

Q: What is the expected impact of successful exploitation?

The CVSS vector indicates low integrity impact, with no confidentiality or availability impact. The issue is described as broken access control caused by incorrectly configured access-control security levels.

Published Nov 11, 2026

Updated

Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tlp-food-menu to a version that resolves this vulnerability.
Fixed in 6.0.8

Event History

Nov 11, 2026

CVE Published

via MITRE·12:37 PM

Data Sourced

via MITRE·12:37 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The affected component is the Food Menu – Restaurant Menu & Online Ordering for WooCommerce WordPress plugin, with versions through 6.0.7 identified as affected. The available data does not specify a lower affected version.

Does exploitation require authentication or user interaction?

No. The provided CVSS vector indicates that the issue is remotely exploitable with low attack complexity and requires neither privileges nor user interaction.

What is the expected impact of successful exploitation?

The CVSS vector indicates low integrity impact, with no confidentiality or availability impact. The issue is described as broken access control caused by incorrectly configured access-control security levels.

CVE-2026-125431: WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.7 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or user interaction?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or user interaction?

What is the expected impact of successful exploitation?