CVE-2023-0550CWE-639

Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference

High · published January 27, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00645 · 50.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2023-01-27T20:17Z
EPSS history
Timeline
  • 27 JAN 20:17Z
    Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference
    cvelistv5