CVE-2026-13328 Overview
CVE-2026-13328 affects The Food Menu WordPress plugin in versions prior to 6.0.2. The plugin exposes a reservation-status update action to unauthenticated users without performing capability or ownership checks. The action is gated only by a nonce that is publicly available to site visitors, which does not constitute an effective access control boundary. Unauthenticated attackers can leverage this flaw to change the status of arbitrary reservations stored by the plugin.
Critical Impact
Unauthenticated attackers can modify the status of any reservation managed by The Food Menu plugin, undermining the integrity of restaurant booking workflows.
Affected Products
- The Food Menu WordPress plugin versions prior to 6.0.2
- WordPress sites running The Food Menu with reservation functionality enabled
- Restaurant and hospitality websites relying on this plugin for booking management
Discovery Timeline
- 2026-08-13 - CVE-2026-13328 published to the National Vulnerability Database
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-13328
Vulnerability Analysis
The vulnerability is a broken access control flaw in the reservation-status update action of The Food Menu WordPress plugin. The action handler is registered on both authenticated and unauthenticated AJAX endpoints, making it reachable by anonymous visitors. The plugin does not verify that the caller holds the required WordPress capability, nor does it confirm ownership of the targeted reservation record.
The only protection applied to the endpoint is a WordPress nonce. Because the nonce is rendered in a page accessible to unauthenticated visitors, any attacker can retrieve it before invoking the action. Nonces are designed to prevent cross-site request forgery, not to serve as authentication tokens. Relying on a public nonce as the sole gate produces an effective authorization bypass.
Successful exploitation lets an attacker toggle reservation records to arbitrary statuses such as confirmed, cancelled, or completed. This can disrupt restaurant operations, corrupt booking state, and enable denial-of-service against legitimate customers.
Root Cause
The root cause is a missing authorization check on a state-changing AJAX action, combined with registration of the action for unauthenticated users. The developer treated nonce verification as sufficient authorization, which conflates CSRF protection with access control.
Attack Vector
An attacker loads a public page on the target site to harvest the nonce, then issues a crafted POST request to the plugin's AJAX endpoint with the reservation identifier and desired status. No credentials, user interaction, or elevated privileges are required. The exploitation flow is documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-13328
Indicators of Compromise
- Unexpected changes to reservation statuses in the plugin's database tables without corresponding administrator activity
- Anonymous POST requests to admin-ajax.php referencing The Food Menu reservation-status action from external IP addresses
- Customer complaints about cancelled or altered bookings that were not modified by staff
Detection Strategies
- Review web server access logs for unauthenticated requests to wp-admin/admin-ajax.php that carry the plugin's reservation status action parameter
- Correlate reservation status changes in the database with authenticated admin session activity to identify orphaned modifications
- Enable WordPress audit logging plugins to record all reservation state transitions along with the requesting user context
Monitoring Recommendations
- Alert on spikes in AJAX traffic targeting the plugin from unauthenticated sessions
- Monitor for repeated requests iterating through sequential reservation IDs, which suggests enumeration
- Track outbound reservation notification emails triggered without a matching admin action
How to Mitigate CVE-2026-13328
Immediate Actions Required
- Update The Food Menu WordPress plugin to version 6.0.2 or later on all affected sites
- Audit the reservation database for unauthorized status changes since the plugin was installed
- Restrict access to admin-ajax.php at the web application firewall for the vulnerable action name until patching is complete
Patch Information
The vendor addressed the issue in The Food Menu version 6.0.2 by adding proper capability and ownership checks to the reservation-status update action. Site administrators should apply the update through the WordPress plugin manager. Additional detail is available in the WPScan Vulnerability Report.
Workarounds
- Temporarily deactivate The Food Menu plugin on sites that cannot be updated immediately
- Deploy a web application firewall rule that blocks unauthenticated POST requests to the plugin's reservation status AJAX action
- Disable public-facing reservation functionality until the patched version is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
