Food Store < 1.3.7 - Unauthorised AJAX call via CSRF

Description

The plugin did not properly check for CSRF in its AJAX actions, allowing attackers to make users perform unwanted actions via a CSRF attack, such as add product add-on (for users with the edit_products capability), as well as add/remove arbitrary products to the basket of the targeted user