https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:11:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337926 EUVD-2026-337926 https://cve.radiocsirt.org/vuln/euvd-2026-337926 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11802 <p>The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the &#39;customer&#39; role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.</p> <p>The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the &#39;customer&#39; role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11802 https://cve.radiocsirt.org/vuln/ghsa-rg6f-xv76-vf59 <p>The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the &#39;customer&#39; role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.</p> <p>The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the &#39;customer&#39; role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.</p> https://cve.radiocsirt.org/vuln/ghsa-rg6f-xv76-vf59