CVE-2024-5459

The Five Star Restaurant Menu and Food Ordering plugin for WordPress contains a capability check vulnerability affecting versions up to 2.4.16 that allows authenticated users with Subscriber privileges or higher to create unauthorized menu data. The plugin fails to properly validate user permissions on the 'add_section', 'add_menu', 'add_menu_item', and 'add_menu_page' functions, enabling low-level users to add menu sections, menus, food items, and new menu pages without appropriate authorization. This was fixed in version 2.4.17.

Based on public CVE data (MITRE/NVD).