Lucene search

CVE-2023-0550

🗓️ 27 Jan 2023 21:11:15Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

Quick Restaurant Menu plugin for WordPress, Insecure Direct Object Reference vulnerability in versions up to 2.0.

Reporter	Title	Published	Views	Family All 8
Vulnrichment	CVE-2023-0550	27 Jan 202320:17	–	vulnrichment
Prion	Design/Logic Flaw	27 Jan 202321:15	–	prion
NVD	CVE-2023-0550	27 Jan 202321:15	–	nvd
Cvelist	CVE-2023-0550	27 Jan 202320:17	–	cvelist
Patchstack	WordPress Quick Restaurant Menu Plugin <= 2.0.2 is vulnerable to Insecure Direct Object References (IDOR)	30 Jan 202300:00	–	patchstack
WPVulnDB	Quick Restaurant Menu < 2.1.0 - Subscriber+ Arbitrary Post Deletion/Updating	27 Jan 202300:00	–	wpvulndb
Wordfence Blog	Multiple Vulnerabilities Patched in Quick Restaurant Menu Plugin	1 Feb 202316:07	–	wordfence
0day.today	WordPress Quick Restaurant 2.0.2 XSS / CSRF / IDOR / Missing Authorization Vulnerabilities	3 Feb 202300:00	–	zdt

Nvd

Vulners

Node

thingsforrestaurants quick_restaurant_menuRange<2.1.0wordpress

[
  {
    "vendor": "alejandropascual",
    "product": "Quick Restaurant Menu",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.0.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/faa4fba5-cd19-4b96-aa09-07ed6d52a107
plugins	www.plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php
plugins	www.plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk

Parameter	Position	Path	Description	CWE
action	request body	/wordpress/wp-admin/admin-ajax.php	The endpoint is vulnerable due to missing authorization checks and insecure direct object reference, allowing authenticated users to delete arbitrary posts.	CWE-852, CWE-284
post_id	request body	/wordpress/wp-admin/admin-ajax.php	The endpoint is vulnerable due to missing authorization checks and insecure direct object reference, allowing authenticated users to delete arbitrary posts.	CWE-852, CWE-284

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

27 Jan 2023 21:15Current

4.7Medium risk

Vulners AI Score4.7

CVSS34.3 - 7.6

EPSS0.00765

SSVC