CVE-2026-13328 — TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated…
Published: 2026-08-13 · CVSS: 5.3 · CVSS 3.1
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7