Five Star Restaurant Menu <= 2.5.4 - Unauthenticated Price Manipulation via Cart Item Data
- ID
- WPSEC-2026-0097
- Plugin
- Five Star Restaurant Menu and Food Ordering (food-and-drink-menu)
- Affected
- from 2.2.0 before 2.6.0
- Remediation
- Update to 2.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-602
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Five Star Restaurant Menu on WPSec AttackSurface
- Fix released
- Published
Description
The Five Star Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to price manipulation in versions 2.2.0 up to, and including, 2.5.4 due to the plugin trusting client-supplied order data, namely the 'selected_price' and 'quantity' values posted to the 'fdm_add_to_cart' AJAX action or stored in the 'fdm_cart' cookie and the 'tip_amount' order parameter, instead of resolving prices from server-side menu item data. This makes it possible for unauthenticated attackers to submit orders with arbitrary item prices and negative quantities or tips, lowering the order total, on sites where online ordering is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0097/
- https://plugins.svn.wordpress.org/food-and-drink-menu/tags/2.6.0/
- https://wordpress.org/plugins/food-and-drink-menu/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS