CVE-2026-13328: TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Food Menu (WordPress plugin)to a version that resolves this vulnerability.Fixed in 6.0.2 - Compensating control
Restrict access to the Food Menu reservation-status update endpoint so only authenticated/authorized users can modify reservation status (since the action is currently exposed to unauthenticated users and only gated by a publicly available nonce).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13328?
CVE-2026-13328 has a risk score of 71, indicating a high severity level.
How do I fix CVE-2026-13328?
To fix CVE-2026-13328, upgrade the Food Menu WordPress plugin to version 6.0.2 or later.
Who is affected by CVE-2026-13328?
Any WordPress site using the Food Menu plugin version prior to 6.0.2 is affected by CVE-2026-13328.
Can CVE-2026-13328 be exploited by unauthenticated attackers?
Yes, CVE-2026-13328 allows unauthenticated attackers to modify reservation statuses due to a lack of proper authorization checks.
What is the primary vulnerability of CVE-2026-13328?
The primary vulnerability of CVE-2026-13328 is the absence of capability checks on the reservation-status update action, making it accessible to unauthenticated users.