CVE-2023-5340

Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection

The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.

Affected

Five Star Restaurant Menu and Food Ordering

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.24% chance of exploitation in the next 30 days, 69th percentile

Published

2023-11-20

Updated

2024-11-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/91a5847a-62e7-4b98-a554-5eecb6a06e5b

References

• CVE Record
• NVD entry