Five Star Restaurant Menu <= 2.5.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Overwrite via Menu Item Import
- ID
- WPSEC-2026-0094
- Plugin
- Five Star Restaurant Menu and Food Ordering (food-and-drink-menu)
- Affected
- from 2.0.0 before 2.6.0
- Remediation
- Update to 2.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Five Star Restaurant Menu on WPSec AttackSurface
- Fix released
- Published
Description
The Five Star Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized modification of data in versions 2.0.0 up to, and including, 2.5.4. The spreadsheet menu item import runs on the 'admin_menu' hook for any request containing 'fdmImport'. It checks only the 'edit_posts' capability (no check at all before 2.3.0), verifies no nonce, and does not check that the post IDs in the spreadsheet belong to menu items. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the title, content and price data of arbitrary posts and pages, converting them into published menu items, and to place spreadsheet files in the plugin's 'user-sheets' directory. Because no nonce is verified, the same action can also be forced via Cross-Site Request Forgery.
References
- https://wpsec.com/vuln/WPSEC-2026-0094/
- https://plugins.svn.wordpress.org/food-and-drink-menu/tags/2.6.0/
- https://wordpress.org/plugins/food-and-drink-menu/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS