CVE-2023-5340

CRITICAL

Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection via AJAX Action

Title source: llm

Description

The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/91a5847a-62e7-4b98-a554-5eecb6a06e5b

Scores

CVSS v3 9.8

EPSS 0.0124

EPSS Percentile 65.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-74

Status published

Products (1)

fivestarplugins/five_star_restaurant_menu < 2.4.11

Published Nov 20, 2023

Tracked Since Feb 18, 2026