CVE-2026-13328

Name of the Vulnerable Software and Affected Versions Food Menu versions prior to 6.0.2

Description An issue exists where the plugin fails to perform capability or ownership checks on the reservation-status update action. This action is exposed to unauthenticated users and is protected only by a nonce (a number used once to prevent replay attacks) that is publicly available to visitors, allowing unauthenticated attackers to modify the status of arbitrary reservations.

Recommendations Update to version 6.0.2 or later.