Five Star Restaurant Menu <= 2.5.4 - Unauthenticated Payment Bypass via Order Submission and Payment Handlers
- ID
- WPSEC-2026-0096
- Plugin
- Five Star Restaurant Menu and Food Ordering (food-and-drink-menu)
- Affected
- from 2.1.4 before 2.6.0
- Remediation
- Update to 2.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Five Star Restaurant Menu on WPSec AttackSurface
- Fix released
- Published
Description
The Five Star Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 2.5.4 due to the order submission handler accepting a user-supplied 'post_status', the Stripe payment handlers taking the charge amount from the client-supplied 'payment_amount' parameter, and the PayPal IPN handler not verifying the payment amount, currency, receiver or payment status against the order. This makes it possible for unauthenticated attackers to set arbitrary order statuses or pay a trivial amount and have their order marked as received when online ordering is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0096/
- https://plugins.svn.wordpress.org/food-and-drink-menu/tags/2.6.0/
- https://wordpress.org/plugins/food-and-drink-menu/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS