CVE-2024-5459

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'add_section', 'add_menu', 'add_menu_item', and 'add_menu_page' functions in all versions up to, and including, 2.4.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create menu sections, menus, food items, and new menu pages.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-54608.1A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before CVE-2024-54618.0Implementation of the Simple Network Management Protocol (SNMP) operating on the Brocade 6547 (FC5022) embedded switch blade, makes intern CVE-2024-54627.5If Brocade Fabric OS before Fabric OS 9.2.0 configuration settings are not set to encrypt SNMP passwords, then the SNMP privsecret / authsec CVE-2024-54636.5A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. CVE-2024-54643.3Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affec CVE-2024-54655.5Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-546586.5The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS CVE-2024-54668.8Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote co CVE-2024-546608.7A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. Attacke CVE-2024-546619.8readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.CVE-2024-546629.1Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.CVE-2024-546637.5An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerab