CVE-2026-13328 TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification
Unauthenticated attackers can modify the status of arbitrary reservations in the TLP Food Menu WordPress plugin due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13328?
CVE-2026-13328 is a medium-severity missing authorization vulnerability in Unknown Food Menu, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
Weakness: CWE-284
Which versions are affected by CVE-2026-13328?
How do I fix CVE-2026-13328?
No fix has been published for CVE-2026-13328 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-13328 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-13328 exists.
Sources
Also known as GHSA-8c32-fr4q-6r3j.