CVE-2026-54835: Five Star Restaurant Menu Auth Bypass Flaw

CVE-2026-54835 Overview

CVE-2026-54835 is an unauthenticated broken access control vulnerability affecting the Five Star Restaurant Menu WordPress plugin in versions 2.5.2 and earlier. The flaw stems from missing authorization checks [CWE-862] on plugin functionality that should require authenticated privileged access. Remote attackers can reach the affected endpoints over the network without credentials or user interaction. The vulnerability primarily impacts data integrity, allowing unauthorized modification of menu-related content managed by the plugin.

Critical Impact
Unauthenticated remote attackers can invoke restricted plugin functionality, resulting in unauthorized modification of restaurant menu data on affected WordPress sites.

Affected Products

Five Star Restaurant Menu (food-and-drink-menu) WordPress plugin versions <= 2.5.2

Discovery Timeline

2026-06-26 - CVE-2026-54835 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-54835

Vulnerability Analysis

The Five Star Restaurant Menu plugin exposes actions that lack proper capability or authorization checks. An unauthenticated attacker sending crafted HTTP requests to the plugin's endpoints can trigger operations reserved for privileged users. The scope is unchanged and the attack requires no privileges, no user interaction, and low complexity.

The impact focuses on integrity. Confidentiality and availability are not directly affected, but unauthorized writes to menu data can be leveraged for content defacement, injection of misleading pricing, or as a pivot for follow-on attacks against site administrators reviewing tampered entries.

The vulnerability sits at the plugin layer of WordPress and does not require any specific server configuration beyond a vulnerable plugin version being active. EPSS data indicates a low near-term exploitation probability, but WordPress plugin flaws with unauthenticated network reach are frequently added to mass-scanning toolkits.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. Plugin handlers execute sensitive operations without verifying the caller's capability through current_user_can() or an equivalent check, and without validating an appropriate nonce. Any HTTP client that can reach the site can invoke the affected functionality.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting the vulnerable plugin. The attacker issues an unauthenticated HTTP request targeting the plugin's exposed action, likely through admin-ajax.php, a REST route, or a plugin-specific endpoint. Because no authentication is required, the attack can be automated at scale against WordPress sites running the plugin.

No verified public exploit code is available at this time. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2026-54835

Indicators of Compromise

Unauthenticated POST requests to admin-ajax.php containing action parameters associated with the food-and-drink-menu plugin.
Unexpected creation, modification, or deletion of menu items, categories, or plugin settings without a corresponding administrator login event.
Requests to plugin REST endpoints under /wp-json/ referencing the Five Star Restaurant Menu plugin from unauthenticated sessions.

Detection Strategies

Inventory WordPress installations and flag any host running food-and-drink-menu at version 2.5.2 or earlier.
Correlate web server access logs with WordPress audit logs to identify plugin actions that fired without a matching authenticated session cookie.
Deploy web application firewall rules that alert on unauthenticated POSTs to plugin-specific action values.

Monitoring Recommendations

Enable WordPress activity logging to record all content modifications with the associated user ID and source IP.
Monitor for surges of requests to admin-ajax.php from single source addresses, a common pattern for plugin abuse scanning.
Track file and database changes to the wp_posts and plugin-owned tables outside of scheduled editorial workflows.

How to Mitigate CVE-2026-54835

Immediate Actions Required

Update the Five Star Restaurant Menu plugin to a version later than 2.5.2 as soon as a fixed release is available from the vendor.
If no fixed version is available, disable and remove the plugin until a patched release is published.
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the web application firewall for unauthenticated sources where feasible.

Patch Information

Refer to the Patchstack advisory for CVE-2026-54835 for the latest fixed version and vendor guidance. Apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

Deactivate the food-and-drink-menu plugin until an upgrade path is applied.
Block unauthenticated requests to plugin-specific admin-ajax.php actions using WAF rules or .htaccess restrictions.
Enforce IP allow-listing on /wp-admin/ to limit exposure of AJAX and REST handlers to trusted networks.

bash

# Example WAF rule concept: block unauthenticated POSTs to plugin actions
# (adapt to your WAF syntax; this is illustrative)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1054835,msg:'Block unauth Five Star Restaurant Menu action'"
  SecRule ARGS:action "@rx ^(fdm_|food_and_drink_menu_)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"