CVE-2026-11802 describes a missing authorization vulnerability (CWE-862) in the FoodBook Lite plugin for WordPress versions up to 1.5.6. The registration() function, triggered via the wp_ajax_nopriv_registration_action AJAX endpoint, lacks nonce verification and capability checks, and does not respect the WordPress users_can_register option before calling wp_insert_user(). This allows unauthenticated attackers to create new user accounts with the 'customer' role and obtain authentication cookies regardless of the site’s user registration settings.

An unauthenticated attacker can create new user accounts with the 'customer' role on affected WordPress sites, bypassing the administrator's settings that disable user registration. This could lead to unauthorized access to customer-level functionality and potentially facilitate further attacks or abuse of the system. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or restricting access to the vulnerable AJAX action or implementing custom authorization checks. Monitoring for unusual account creation activity may also help detect exploitation attempts.