CVE-2020-29045 Deserialization in n/a
Remote attackers can execute arbitrary code via unsafe deserialization of the fdm_cart cookie in the food-and-drink-menu WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-29045?
CVE-2020-29045 is a critical unsafe deserialization vulnerability in n/a, published on 11 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm_cart cookie in load_cart_from_cookie in includes/class-cart-manager.php.
Weakness: CWE-502
Which versions are affected by CVE-2020-29045?
It affects 1 product.
Products include Fivestarplugins Five Star Restaurant Menu.
How do I fix CVE-2020-29045?
No fix has been published for CVE-2020-29045 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-29045 being exploited?
There is no known exploitation of CVE-2020-29045 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-5340 Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection
- CVE-2023-34017 WordPress Five Star Restaurant Reservations Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-24838 WordPress Five Star Restaurant Reviews Plugin <= 2.3.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-5459 Restaurant Menu and Food Ordering <= 2.4.16 - Missing Authorization to Menu Creation
- CVE-2023-37985 WordPress Five Star Restaurant Menu Plugin <= 2.4.6 is vulnerable to Cross Site Request Forgery (CSRF)
Sources
Also known as GHSA-467c-6whc-qp44.