CVE-2026-11802

MediumCVSS 5.3/10Last modified Jul 15, 2026

Description

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 14, 2026
Last modified: Jul 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1180208.8Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180218.8Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7 CVE-2026-1180228.8Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 15 CVE-2026-1180238.8Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180248.8Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunder CVE-2026-1180258.8Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180268.8Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180279.1Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.CVE-2026-1180295.9Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow CVE-2026-118037.8A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can lev CVE-2026-1180304.2A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management serv CVE-2026-1180357.5In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity