CVE-2026-13328 - TLP Food Menu 6.0.2 - Unauthenticated Reservation Status Modification
Brief
CVE ID : CVE-2026-13328
Published : Aug. 13, 2026, 6:17 a. m.
- 2 hours, 47 minutes ago
Description : The Food Menu WordPress plugin before 6.
- 2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
Severity: 0.0
- NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...