CVE-2026-11802

Name of the Vulnerable Software and Affected Versions FoodBook Lite - Online Food Ordering System versions prior to 1.5.7

Description Missing authorization in the registration() function allows unauthenticated attackers to create new user accounts with the 'customer' role and obtain authentication cookies. This occurs because the function, accessed via the wp ajax nopriv registration action AJAX action, fails to perform nonce verification, capability checks, or verify the users can register option before executing wp insert user(). This bypasses administrative settings that disable user registration.

Recommendations Update FoodBook Lite - Online Food Ordering System to version 1.5.7 or later.