CVE-2022-3776 Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.1 - Cross-Site Request Forgery
Unauthenticated attackers can trick administrators into performing administrative actions like modifying forms via forged requests due to missing nonce validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3776?
CVE-2022-3776 is a high-severity vulnerability in gloriafood Restaurant Menu – Food Ordering System – Table Reservation, published on 3 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible for unauthenticated attackers to perform a variety of administrative actions like modifying forms, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Weakness: CWE-352
Which versions are affected by CVE-2022-3776?
It affects 1 product.
Products include Oracle Restaurant Menu - Food Ordering System - Table Reservation.
How do I fix CVE-2022-3776?
No fix has been published for CVE-2022-3776 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3776 being exploited?
There is no known exploitation of CVE-2022-3776 in the wild and no public exploit code.
Other vulnerabilities in gloriafood Restaurant Menu – Food Ordering System – Table Reservation
- CVE-2023-32516 Cross-site scripting in Restaurant Menu – Food Ordering System – Table Reservation
- CVE-2022-2696 Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actions
- CVE-2024-9653 Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting
- CVE-2022-4657 Restaurant Menu < 2.3.6 - Contributor+ Stored XSS via Shortcode
Sources
Also known as GHSA-xhm2-m35v-2xw7.