What is the CVSS score of CVE-2026-11802?

CVE-2026-11802 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

FoodBook Lite CVE-2026-11802

EUVD-2026-43610 MEDIUM

Missing Authorization (CWE-862)

2026-07-14 Wordfence

GHSA-rg6f-xv76-vf59

WordPress Authentication Bypass Wordpress Plugin Foodbook Lite Online Food Ordering System Themelooks

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Publicly accessible unauthenticated AJAX endpoint with no complexity; only limited integrity impact (account creation at customer role); no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 02:31 vuln.today

CVE Published

Jul 14, 2026 - 01:30 nvd

MEDIUM 5.3

DescriptionCVE.org

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.

AnalysisAI

Unauthorized account self-registration in the FoodBook Lite WordPress plugin through version 1.5.6 allows unauthenticated remote attackers to create 'customer'-role accounts and obtain valid WordPress authentication cookies, even when the site administrator has explicitly disabled user registration. The flaw exists because the plugin's registration() function is registered on the publicly accessible wp_ajax_nopriv_registration_action AJAX hook and calls wp_insert_user() without performing nonce verification, capability checks, or consulting the users_can_register site option. No public exploit has been identified at time of analysis and no KEV listing exists; Wordfence reported the issue with a confirmed fix in version 1.5.7.

Technical ContextAI

The vulnerability resides in inc/class-components-ajax.php of the FoodBook Lite plugin (CPE: cpe:2.3:a:themelooks:foodbook_lite_-_online_food_ordering_system), developed by Themelooks and designed for online food ordering on WordPress. WordPress's wp_ajax_nopriv_ hook prefix is specifically intended for unauthenticated front-end AJAX actions - any handler registered under this prefix is publicly callable at wp-admin/admin-ajax.php with no authentication required. The registration() function (visible at line 86 of the 1.5.6 tag) invokes wp_insert_user() directly, skipping three independent safeguards: nonce verification (which would prevent CSRF-style abuse), a capability check (which would enforce WordPress role-based access control), and a check against get_option('users_can_register') (the site-wide toggle that administrators use to close public registration). CWE-862 (Missing Authorization) applies precisely because a privileged operation - account provisioning - is executed without any verification that the caller is authorized. The patched 1.5.7 release introduces remediation visible in class-components-ajax.php lines 67-73 and helper-functions.php lines 724-725.

RemediationAI

Upgrade FoodBook Lite to version 1.5.7 or later; this release introduces the missing nonce verification, capability check, and users_can_register option check in class-components-ajax.php and helper-functions.php, as confirmed by Trac diffs at the plugin's repository for the 1.5.7 tag. Until the upgrade can be applied, deactivating the FoodBook Lite plugin entirely removes the exposed AJAX endpoint, at the cost of disabling all online food ordering functionality on the site. As an alternative compensating control, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php where the action parameter equals registration_action can neutralize exploitation without disabling the plugin; verify this does not interfere with any intentional front-end registration flows before deploying. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8b67557c-785f-433b-8e5b-fcc0bda14892 provides additional context and should be consulted for timeline and patch confirmation.