WordPress Plugin Vulnerabilities

Restaurant Menu and Food Ordering < 2.4.12 - Missing Authorization

Description

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.4.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
mp-restaurant-menu
Fixed in 2.4.12

References

CVE
CVE-2025-63078
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/517f0c5e-7a73-475c-8676-9cd031ca6d9a

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
b15cc49b-b1e6-4741-b887-b45f2a722139

Timeline

Publicly Published
2026-06-26 (about 2 months ago)
Added
2026-06-29 (about 2 months ago)
Last Updated
2026-09-09 (about 3 days ago)

Other

Published
Title
Published
2025-10-21
Title
VikBooking Hotel Booking Engine & PMS < 1.8.3 - Missing Authorization
Published
2023-09-13
Title
WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update
Published
2025-09-22
Title
Post Carousel Slider for Elementor <= 1.7.0 - Missing Authorization
Published
2025-10-02
Title
Constructor <= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean
Published
2025-12-11
Title
Premmerce Brands for WooCommerce < 1.2.14 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update