CVE-2026-11802 describes a missing authorization vulnerability (CWE-862) in the FoodBook Lite plugin for WordPress, affecting all versions up to and including 1.5.6. The vulnerability arises because the registration() function, triggered via the wp_ajax_nopriv_registration_action AJAX endpoint, does not implement nonce verification or capability checks, nor does it verify the WordPress users_can_register option before invoking wp_insert_user(). Consequently, unauthenticated attackers can create new user accounts with the 'customer' role and receive authentication cookies, bypassing administrative restrictions on user registration.

An attacker can create new user accounts with the 'customer' role without authentication, even when user registration is disabled. This unauthorized account creation can lead to unauthorized access to customer-level functionality and potentially facilitate further attacks or abuse of the system. The vulnerability does not allow privilege escalation beyond the 'customer' role, nor does it impact confidentiality or availability directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or restricting access to the vulnerable AJAX action if possible. Monitoring for unauthorized account creation may help detect exploitation attempts. Do not rely on the users_can_register setting alone to prevent registrations in this plugin version.