Retour à la veille

CVE-2026-13328

Publié : 13 août 2026
Modifié : 13 août 2026
Lien officiel NVD

Description détaillée

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.

Références et Patchs