What is the CVSS score of CVE-2026-54835?

CVE-2026-54835 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Five Star Restaurant Menu are affected by CVE-2026-54835?

The Five Star Restaurant Menu WordPress plugin (versions ≤2.5.2) contains an authorization bypass vulnerability allowing unauthenticated attackers to modify restaurant menu data without any…

How to fix or mitigate CVE-2026-54835?

Within 24 hours: Inventory all WordPress installations and identify which are running Five Star Restaurant Menu plugin versions ≤2.5.2. Within 7 days: Disable the plugin entirely or implement WordPress capability restrictions to prevent unauthenticated users from accessing plugin functions. Within 30 days: Monitor Patchstack and vendor advisory channels for patch release; if patch is not issued, migrate to an alternative menu management plugin with active security support.

Five Star Restaurant Menu CVE-2026-54835

EUVD-2026-39679 HIGH

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-8gj3-qcvj-2568

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable endpoint with missing authorization gives AV:N/AC:L/PR:N/UI:N; integrity-only impact per broken-access-control write, so C:N/I:H/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:36 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

AnalysisAI

Improper authorization in the Five Star Restaurant Menu WordPress plugin (versions <= 2.5.2) lets unauthenticated remote attackers invoke restricted functionality and modify data without any credentials. The CVSS 3.1 vector (AV:N/PR:N/UI:N) and CWE-862 indicate the plugin exposes one or more actions that lack capability/nonce checks, scored 7.5 with integrity-only impact (C:N/I:H/A:N). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Patchstack's audit team and tagged as an Authentication Bypass.

Technical ContextAI

The affected component is the Five Star Restaurant Menu plugin (vendor slug 'food-and-drink-menu') for WordPress, used to publish restaurant menu listings. The root cause is CWE-862 (Missing Authorization): a server-side handler - typically a WordPress AJAX action (wp_ajax_nopriv_*), REST route, or admin-post endpoint - executes a privileged operation without verifying the caller's capability or a valid nonce. Because WordPress plugins frequently register such endpoints to be reachable by any web client, the missing current_user_can()/check_ajax_referer() guard allows callers who hold no authenticated session to reach logic intended only for menu editors or administrators. The CVSS impact profile (I:H, C:N, A:N) signals the exposed action primarily writes or changes data rather than reading secrets or causing downtime.

RemediationAI

No vendor-released patch version was identified in the provided data, so update to the latest available release of the Five Star Restaurant Menu plugin and consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/food-and-drink-menu/vulnerability/wordpress-five-star-restaurant-menu-plugin-2-5-2-broken-access-control-vulnerability?_s_id=cve) for the fixed version once published, since versions <= 2.5.2 are vulnerable. As compensating controls until a confirmed fixed build is installed: deploy Patchstack's vPatch or a WAF rule to block requests to the plugin's vulnerable AJAX/REST endpoints (trade-off: may break legitimate menu-editing AJAX if rules are too broad); restrict access to /wp-admin/admin-ajax.php and the plugin's REST namespace via authentication or IP allowlisting on staging/low-traffic sites (trade-off: can disrupt front-end menu features that rely on those endpoints); or deactivate the plugin entirely if the menu functionality is non-essential (trade-off: removes the menu feature from the site). Verify any control against the site's normal traffic to avoid breaking legitimate functionality.