Lucene search
PRIOn knowledge basePRION:CVE-2023-0554HistoryJan 27, 2023 - 9:15 p.m.
Cross site request forgery (csrf)
2023-01-2721:15:00
PRIOn knowledge base
www.prio-n.com
4
wordpress
csrf vulnerability
ajax actions
nonce validation
unauthenticated attackers
menu items
site administrator
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
| CPE | Name | Operator | Version |
|---|---|---|---|
| quick_restaurant_menu | lt | 2.1.0 |
References
plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php
plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk
www.wordfence.com/threat-intel/vulnerabilities/id/bfc7c214-8d76-453c-a05d-682aa425b06e
Related
wpvulndb
wpvulndb
Quick Restaurant Menu < 2.1.0 - Menu Items Update via CSRF
2023-01-27 00:00:00
nvd
nvd
CVE-2023-0554
2023-01-27 21:15:11
cve
cve
CVE-2023-0554
2023-01-27 21:15:11
cvelist
cvelist
CVE-2023-0554
2023-01-27 20:28:40
zdt
zdt
wordfence
wordfence
Multiple Vulnerabilities Patched in Quick Restaurant Menu Plugin
2023-02-01 16:07:08