EUVD-2026-70992

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-84044: Undefined Security Weakness

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

PT-2026-85466

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-73400

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73400 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

EUVD-2026-60806

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73400 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73400

CVE-2026-73400 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress plugin Restaurant Menu by MotoPress , affecting versions 2.4.11 and below . The flaw allows a remote, unauthenticated attacker to include and read local files on the server, potentially leading to full ...

CVE-2026-73400

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.11...

PT-2026-77120

Name of the Vulnerable Software and Affected Versions Restaurant Menu by MotoPress versions prior to 2.4.12 Description An unauthenticated Local File Inclusion LFI exists, which allows a remote attacker to read files from the server without requiring user interaction. Local File Inclusion is a...

CVE-2026-73400: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

VulnCheck KEV: CVE-2026-73400

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-15147 Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

CVE-2026-15147: Insufficient Verification of Data Authenticity

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

CVE-2026-15151 Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

CVE-2026-15151 Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

WordPress Five Star Restaurant Reservations plugin < 2.7.23 - Booking Manager+ Missing Authorization vulnerability

Booking Manager+ Missing Authorization vulnerability discovered by Minar in WordPress Plugin Five Star Restaurant Reservations versions 2.7.23...

CVE-2026-15151: Improper Access Control

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

CVE-2026-11818: Missing Authorization

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...