Food Menu WordPress plugin: Missing authorization check (CVE-2026-125431)
Summary
The WordPress plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce (tlp-food-menu) up to version 6.0.7 lacks a proper authorization check. According to the CVE record and Patchstack, an attacker may be able to access functions they should not reach. The CVSS base score is 5.3 (medium), with low integrity impact and no confidentiality or availability impact. The specific affected function is not described in the sources reviewed.
Affected
- Food Menu – Restaurant Menu & Online Ordering for WooCommerce (WordPress plugin tlp-food-menu)
- Versions from n/a through 6.0.7
- Vendor attribution differs between sources (Mamunur Rashid; software author techlabpro1 per Wordfence)
Fixed in
- Version 6.0.8 (according to the CVE record and OffSeq)
- Note: the 6.0.8 release was not confirmed on the WordPress.org listing during research; verify before relying on it.
Workaround
Unknown.
- If an update is not possible promptly, deactivate the plugin on public sites or restrict access to its endpoints at the web server or WAF (not a vendor statement).
Exploitation
- No known exploitation (OffSeq: not known to be exploited; Strix: KEV No).
- CISA SSVC: Exploitation none, automatable yes, technical impact partial.
- No public proof of concept found in the research; this is not a confirmed absence.
Our recommendation
- Identify all WordPress sites running the plugin and their versions.
- Update to version 6.0.8 or later, then verify the installed plugin version.
- If you cannot update, deactivate the plugin on public sites.
- Review the Patchstack advisory for the affected function and check the plugin's other recent advisories (CVE-2026-13328, CVE-2026-42709).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125431 www.cve.org
- Patchstack advisory patchstack.com
- OffSeq Radar CVE-2026-125431 radar.offseq.com
- Strix CVE-2026-125431 www.strix.ai
- Wordfence threat intelligence for tlp-food-menu www.wordfence.com
- WordPress.org plugin listing wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:42.
Original description (NVD)
Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.