CVE-2022-2696 Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actions
Authenticated attackers with minimal permissions can modify plugin settings and ordering preferences due to missing authorization checks in AJAX actions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2696?
CVE-2022-2696 is a medium-severity missing authorization vulnerability in gloriafood Restaurant Menu – Food Ordering System – Table Reservation, published on 3 Nov 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions up to, and including 2.3.0 due to missing capability checks and missing nonce validation. This makes it possible for authenticated attackers with minimal permissions to perform a wide variety of actions such as modifying the plugin's settings and modifying the ordering system preferences.
Weakness: CWE-862
Which versions are affected by CVE-2022-2696?
It affects 1 product.
Products include Oracle Restaurant Menu - Food Ordering System - Table Reservation.
How do I fix CVE-2022-2696?
No fix has been published for CVE-2022-2696 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-2696 being exploited?
There is no known exploitation of CVE-2022-2696 in the wild and no public exploit code.
Other vulnerabilities in gloriafood Restaurant Menu – Food Ordering System – Table Reservation
- CVE-2022-3776 Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.1 - Cross-Site Request Forgery
- CVE-2023-32516 Cross-site scripting in Restaurant Menu – Food Ordering System – Table Reservation
- CVE-2024-9653 Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting
- CVE-2022-4657 Restaurant Menu < 2.3.6 - Contributor+ Stored XSS via Shortcode
Sources
Also known as GHSA-xjvc-8mfj-g22v.