The Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin for WordPress suffers from a missing capability check in its response() function across all versions up to 5.1.4. This authorization bypass vulnerability (CWE-862) enables authenticated users with low privileges (Subscriber-level and above) to alter plugin settings, potentially impacting the integrity of the plugin configuration. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low attack complexity and no user interaction required.

An attacker with authenticated Subscriber-level access or higher can modify the plugin's settings without proper authorization. This could lead to unauthorized changes in the plugin configuration, potentially affecting the behavior of the restaurant menu and online ordering system. There is no direct impact on confidentiality or availability reported. No known exploits are currently documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to plugin settings changes. Avoid granting unnecessary privileges to low-level authenticated users.