CVE-2023-5340 Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection

What is CVE-2023-5340?

CVE-2023-5340 is a critical unsafe deserialization vulnerability in Unknown Five Star Restaurant Menu and Food Ordering, published on 20 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.

Weakness: CWE-74

Which versions are affected by CVE-2023-5340?

It affects 1 product.

Products include Fivestarplugins Five Star Restaurant Menu.

How do I fix CVE-2023-5340?

No fix has been published for CVE-2023-5340 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-5340 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5340 exists.

Other vulnerabilities in Unknown Five Star Restaurant Menu and Food Ordering

• CVE-2020-29045 Deserialization in n/a Critical 9.8
• CVE-2023-34017 WordPress Five Star Restaurant Reservations Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS) High 7.1
• CVE-2024-24838 WordPress Five Star Restaurant Reviews Plugin <= 2.3.5 is vulnerable to Cross Site Scripting (XSS) Medium 6.5
• CVE-2024-5459 Restaurant Menu and Food Ordering <= 2.4.16 - Missing Authorization to Menu Creation Medium 4.3
• CVE-2023-37985 WordPress Five Star Restaurant Menu Plugin <= 2.4.6 is vulnerable to Cross Site Request Forgery (CSRF) Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v88m-92x2-qxm5.