Security readout for executives and security teams
Plain-English summary
CVE-2020-29045 is a remote code execution issue in the Food and Drink Menu WordPress plugin through version 2.2.0. A public website using the vulnerable plugin could allow an unauthenticated remote attacker to influence server-side code execution through a crafted cart cookie.
Executive priority
Treat this as a high-priority WordPress exposure if the plugin is present. Remote code execution on a public website can lead to site takeover, data theft, malware placement, or broader hosting compromise.
Technical view
The reported flaw is unsafe unserialization of the fdm_cart cookie in load_cart_from_cookie within includes/class-cart-manager.php. The CVE states this can allow remote attackers to execute arbitrary code. No CVSS score, CWE mapping, or fixed version is provided in the source bundle.
Likely exposure
Exposure is likely limited to WordPress sites running the food-and-drink-menu plugin at version 2.2.0 or earlier. Public-facing restaurant or menu sites using this plugin should be prioritized for inventory and version checks.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. The issue is still serious because the CVE describes remote arbitrary code execution through attacker-controlled cookie data.
Researcher notes
Evidence is narrow but specific: affected plugin versions through 2.2.0 and the vulnerable cookie unserialize path are named. The source bundle does not provide exploit maturity, patch details, CVSS, or observed exploitation evidence.
Mitigation direction
- Identify all WordPress sites using the food-and-drink-menu plugin.
- Check the installed plugin version against version 2.2.0 or earlier.
- Review the WordPress plugin page and vendor guidance for fixed releases.
- Upgrade, disable, or remove vulnerable installations if no safe version is confirmed.
- Review web server and WordPress logs for suspicious requests involving fdm_cart.
Validation and detection
- Confirm whether the plugin is installed on each WordPress site.
- Record the exact installed plugin version from WordPress administration or filesystem inventory.
- Verify whether fdm_cart handling is present in includes/class-cart-manager.php.
- Check security tooling for alerts tied to CVE-2020-29045.
- Document remediation status for each affected site.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-29045 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wordpress.org/plugins/food-and-drink-menu/#developersCVE reference · x_refsource_MISC
- https://appcheck-ng.com/cve-2020-29045/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.