WordPress Plugin Vulnerabilities

WPPizza – A Restaurant Plugin < 3.20 - Authenticated (Subscriber+) Information Exposure

Description

The WPPizza – A Restaurant Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.19.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
wppizza
Fixed in 3.20

References

CVE
CVE-2026-40796
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/eda25531-3f5f-4f66-8c6a-fcb17342eac0

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Muhan Luo
Verified
No
WPVDB ID
0611211f-77d0-4b1d-8dab-bee87c5cc048

Timeline

Publicly Published
2026-04-29 (about 4 months ago)
Added
2026-05-04 (about 4 months ago)
Last Updated
2026-05-04 (about 4 months ago)

Other

Published
Title
Published
2025-11-07
Title
Uncanny Automator < 6.10.0 - Authenticated (Subscriber+) Information Exposure
Published
2021-09-22
Title
Ninja Forms < 3.5.8 - Unprotected REST-API to Sensitive Information Disclosure
Published
2025-07-16
Title
JetEngine < 3.7.1.1 - Authenticated (Subscriber+) Information Exposure
Published
2026-08-04
Title
Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
Published
2026-03-17
Title
Nelio AB Testing < 8.3.0 - Unauthenticated Information Exposure