CVE-2026-13328

The CVE concerns the Food Menu WordPress plugin (versions before 6.0.2). The issue is a missing capability/ownership check on the reservation-status update action, which is accessible to unauthenticated users and only protected by a publicly known nonce. This permits unauthenticated attackers to ...