WordPress Plugin Vulnerabilities

Best Restaurant Menu by PriceListo < 1.4.3 - Missing Authorization

Description

The Best Restaurant Menu by PriceListo plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a few functions like 'delete_group' in versions up to, and including, 1.4.2. This makes it possible for authenticated attackers, with contributor-level access and above, to perform actions they should not be authorized to.

Affects Plugins

Plugin icon
best-restaurant-menu-by-pricelisto
Fixed in 1.4.3

References

CVE
CVE-2024-49698
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/acd55f15-43b6-481c-a3d2-3c29943caf69

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
9485d3d0-7439-4709-ad6f-d35fbb2cb27f

Timeline

Publicly Published
2024-10-21 (about 1 year ago)
Added
2024-10-30 (about 1 year ago)
Last Updated
2024-10-30 (about 1 year ago)

Other

Published
Title
Published
2025-12-14
Title
Views Counter < 2.1.3 - Missing Authorization
Published
2025-12-15
Title
FileBird – WordPress Media Library Folders & File Manager < 6.5.2 - Missing Authorization to Authenticated (Author+) Global Folders Tampering
Published
2024-07-19
Title
Security Optimizer – The All-In-One Protection Plugin < 1.5.1 - Missing Authorization via hide_notice()
Published
2025-12-22
Title
FV Simpler SEO < 1.9.7 - Missing Authorization
Published
2024-07-11
Title
Image Optimizer, Resizer and CDN – Sirv < 7.2.8 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update