CVE-2023-0554

🗓️ 27 Jan 2023 20:28:40Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 51 Views🌐 WEB

The Quick Restaurant Menu plugin for WordPress is vulnerable to CSRF in versions up to 2.0.2 due to missing nonce validation

Reporter	Title	Published	Views	Family All 14
0day.today	WordPress Quick Restaurant 2.0.2 XSS / CSRF / IDOR / Missing Authorization Vulnerabilities	3 Feb 202300:00	–	zdt
ATTACKERKB	CVE-2023-0554	27 Jan 202321:15	–	attackerkb
CNNVD	WordPress plugin Quick Restaurant Menu 跨站请求伪造漏洞	27 Jan 202300:00	–	cnnvd
Cvelist	CVE-2023-0554 Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery	27 Jan 202320:28	–	cvelist
EUVD	EUVD-2023-12599	3 Oct 202520:07	–	euvd
NVD	CVE-2023-0554	27 Jan 202321:15	–	nvd
OSV	CVE-2023-0554	27 Jan 202321:15	–	osv
Patchstack	WordPress Quick Restaurant Menu Plugin <= 2.0.2 is vulnerable to Cross Site Request Forgery (CSRF)	30 Jan 202300:00	–	patchstack
Prion	Cross site request forgery (csrf)	27 Jan 202321:15	–	prion
Positive Technologies	PT-2023-16358 · WordPress · Quick Restaurant Menu	27 Jan 202300:00	–	ptsecurity

NVD

Vulners

Node

thingsforrestaurants quick_restaurant_menuRange<2.1.0wordpress

[
  {
    "vendor": "alejandropascual",
    "product": "Quick Restaurant Menu",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.0.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php
plugins	www.plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bfc7c214-8d76-453c-a05d-682aa425b06e
wordfence	www.wordfence.com/blog/2023/02/multiple-vulnerabilities-patched-in-quick-restaurant-menu-plugin/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bfc7c214-8d76-453c-a05d-682aa425b06e

Parameter	Position	Path	Description	CWE
action	request body	wordpress/wp-admin/admin-ajax.php	CSRF-vulnerable AJAX action allowing manipulation of menu items without proper authorization checks (example: erd_delete_menu_item with post_id)	CWE-352
post_id	request body	wordpress/wp-admin/admin-ajax.php	CSRF-vulnerable AJAX action allowing manipulation of menu items without proper authorization checks (example: erd_delete_menu_item with post_id)	CWE-352

08 Apr 2026 19:18Current

4.5Medium risk

Vulners AI Score4.5

CVSS 3.14.3 - 8.1

EPSS0.00195

SSVC

CWE-352