UNKNOWN NVD

CVE-2026-13328

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed t

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.

References

https://wpscan.com/vulnerability/af15ecd8-a656-45ab-a1d4-85704d6d8051/

Published: 2026-08-13 · Source: NVD · Feed updated: 2026-08-13

This unknown severity vulnerability was published on 2026-08-13 via NVD.

vulnfeed aggregates 10489 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.