CVE-2023-0550

🗓️ 27 Jan 2023 20:17:19Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 77 Views🌐 WEB

Quick Restaurant Menu plugin for WordPress, Insecure Direct Object Reference vulnerability in versions up to 2.0.

Reporter	Title	Published	Views	Family All 14
0day.today	WordPress Quick Restaurant 2.0.2 XSS / CSRF / IDOR / Missing Authorization Vulnerabilities	3 Feb 202300:00	–	zdt
ATTACKERKB	CVE-2023-0550	27 Jan 202321:15	–	attackerkb
Circl	CVE-2023-0550	11 Dec 202304:34	–	circl
CNNVD	WordPress plugin Quick Restaurant Menu 安全漏洞	27 Jan 202300:00	–	cnnvd
Cvelist	CVE-2023-0550 Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference	27 Jan 202320:17	–	cvelist
EUVD	EUVD-2023-12595	3 Oct 202520:07	–	euvd
NVD	CVE-2023-0550	27 Jan 202321:15	–	nvd
Patchstack	WordPress Quick Restaurant Menu Plugin <= 2.0.2 is vulnerable to Insecure Direct Object References (IDOR)	30 Jan 202300:00	–	patchstack
Prion	Design/Logic Flaw	27 Jan 202321:15	–	prion
Positive Technologies	PT-2023-16355 · WordPress · Quick Restaurant Menu	27 Jan 202300:00	–	ptsecurity

NVD

Vulners

Node

thingsforrestaurants quick_restaurant_menuRange<2.1.0wordpress

[
  {
    "vendor": "alejandropascual",
    "product": "Quick Restaurant Menu",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.0.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/faa4fba5-cd19-4b96-aa09-07ed6d52a107
plugins	www.plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk
wordfence	www.wordfence.com/blog/2023/02/multiple-vulnerabilities-patched-in-quick-restaurant-menu-plugin/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/faa4fba5-cd19-4b96-aa09-07ed6d52a107

Parameter	Position	Path	Description	CWE
action	request body	/wordpress/wp-admin/admin-ajax.php	Insecure Direct Object Reference via AJAX action without validating the post type, enabling modification/deletion of arbitrary items when post_id of a non-menu type is supplied by an authenticated user.	CWE-639
post_id	request body	/wordpress/wp-admin/admin-ajax.php	Insecure Direct Object Reference via AJAX action without validating the post type, enabling modification/deletion of arbitrary items when post_id of a non-menu type is supplied by an authenticated user.	CWE-639

17 Jun 2026 05:25Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.14.3 - 8.1

EPSS0.0065

SSVC

CWE-639