CVE-2026-11802 Overview
CVE-2026-11802 is a Missing Authorization vulnerability [CWE-862] affecting the FoodBook Lite - Online Food Ordering System plugin for WordPress in all versions up to and including 1.5.6. The plugin's registration() function, exposed through the wp_ajax_nopriv_registration_action AJAX endpoint, omits nonce verification, capability checks, and does not consult the WordPress users_can_register option before invoking wp_insert_user(). Unauthenticated attackers can create arbitrary customer accounts and receive valid authentication cookies, even when administrators have explicitly disabled user registration.
Critical Impact
Unauthenticated attackers can bypass the site's registration policy to create authenticated customer accounts on any WordPress site running FoodBook Lite ≤ 1.5.6.
Affected Products
- FoodBook Lite - Online Food Ordering System plugin for WordPress
- All versions up to and including 1.5.6
- Fixed in version 1.5.7
Discovery Timeline
- 2026-07-14 - CVE-2026-11802 published to the National Vulnerability Database
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-11802
Vulnerability Analysis
The flaw resides in inc/class-components-ajax.php within the FoodBook Lite plugin. The registration() handler is registered to the wp_ajax_nopriv_registration_action hook, making it callable by unauthenticated visitors through the standard /wp-admin/admin-ajax.php endpoint. The handler accepts user-supplied fields and forwards them to wp_insert_user() without validating the request context.
Because no nonce is checked, requests cannot be tied back to a legitimate front-end form. Because no capability check is performed, the caller's privilege level is never evaluated. Because the WordPress users_can_register site option is ignored, attackers can create accounts on sites where the administrator has closed registration entirely. After account creation, the handler issues authentication cookies, returning a fully logged-in customer session to the attacker.
Root Cause
The root cause is the absence of authorization controls on a state-changing AJAX action exposed to unauthenticated users. WordPress plugin authors are expected to gate account-creation logic behind check_ajax_referer(), capability checks, and the users_can_register option. The 1.5.6 branch of FoodBook Lite implements none of these controls. The fix in 1.5.7 introduces the missing validation in inc/class-components-ajax.php and inc/helper-functions.php.
Attack Vector
Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP POST to /wp-admin/admin-ajax.php with action=registration_action and the registration parameters expected by the plugin. The server responds with a Set-Cookie header carrying valid WordPress authentication cookies for the newly created customer account. The attacker can then access any front-end functionality restricted to authenticated customers, place fraudulent orders, or leverage the foothold to probe additional plugins for privilege-escalation flaws.
Refer to the Wordfence Vulnerability Report and the WordPress plugin source at line 18 of class-components-ajax.php for the vulnerable code path.
Detection Methods for CVE-2026-11802
Indicators of Compromise
- Unexpected new user accounts assigned the customer role in wp_users, particularly on sites where the users_can_register option is set to 0.
- POST requests to /wp-admin/admin-ajax.php containing action=registration_action originating from unauthenticated sessions.
- Set-Cookie responses issuing wordpress_logged_in_* cookies immediately following an anonymous AJAX registration call.
- Bursts of account creations from a single IP address or narrow IP range within a short time window.
Detection Strategies
- Monitor web server access logs for POST requests to admin-ajax.php where the request body contains registration_action and correlate with subsequent authenticated activity from the same client.
- Query the WordPress database for customer role accounts created after the plugin was installed and compare against expected registration volume.
- Alert when new WordPress accounts are created while the users_can_register site option is disabled — this combination indicates authorization bypass.
Monitoring Recommendations
- Enable WordPress audit logging (via a security plugin or database triggers) to capture every wp_insert_user() call with source IP and referrer.
- Forward web server and WordPress audit logs to a centralized SIEM or data lake and build detections for anonymous account creation patterns.
- Track the plugin file inc/class-components-ajax.php for version drift to confirm remediation is in place.
How to Mitigate CVE-2026-11802
Immediate Actions Required
- Upgrade the FoodBook Lite - Online Food Ordering System plugin to version 1.5.7 or later on every affected WordPress site.
- Audit the wp_users table for unauthorized customer accounts created since the plugin was installed and remove any that are illegitimate.
- Invalidate active sessions by rotating authentication salts in wp-config.php to force reauthentication of any attacker-created sessions.
Patch Information
The vendor addressed the flaw in FoodBook Lite version 1.5.7. The patch adds nonce verification, checks the WordPress users_can_register option, and validates request parameters before calling wp_insert_user(). Review the fix in class-components-ajax.php at line 39 in tag 1.5.7 and the supporting helper changes in helper-functions.php lines 724-725.
Workarounds
- If patching cannot be performed immediately, deactivate and remove the FoodBook Lite plugin until the upgrade is applied.
- Block requests to /wp-admin/admin-ajax.php with action=registration_action at the web application firewall or reverse proxy layer.
- Restrict access to admin-ajax.php from untrusted networks where feasible, or enforce rate limiting on the endpoint to reduce automated abuse.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
