Foodbook Lite – Online Food Ordering System
Approved changes feed: RSS · Atom
cpe:2.3:a:themelooks:foodbook_lite_–_online_food_ordering_system:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Themelooks (e8868196-b475-524f-a03e-f0b237b30f62) |
|---|---|
| Product | Foodbook Lite – Online Food Ordering System (70c4b9a9-ca3e-5101-bf42-4342f9666dfc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-11802 |
vulnerable | 2026-07-29 00:23:31.642371 |
FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action
MEDIUM (5.3)
The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.
Published: 2026-07-14T01:30:00.701Z
Updated: 2026-07-15T13:39:53.630Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.