Security readout for executives and security teams
Plain-English summary
A low-privileged WordPress user could abuse Quick Restaurant Menu to change or delete posts that were not restaurant menu items. For a business site, the main impact is content integrity and availability: pages, posts, or operational content could be damaged by any authenticated account with subscriber access or higher.
Executive priority
Treat this as high priority for affected WordPress sites, especially where customers, contributors, or unknown users can hold accounts. It is not documented as actively exploited here, but the business impact can be visible content loss or unauthorized changes.
Technical view
CVE-2023-0550 is an IDOR in Quick Restaurant Menu through 2.0.2. The AJAX delete/modify flow accepted a post ID without verifying that the post was a menu item. Authenticated users with subscriber-level access or higher could modify or delete arbitrary posts. CVSS is 8.1, CWE-639.
Likely exposure
Exposure is limited to WordPress sites running Quick Restaurant Menu versions up to and including 2.0.2, where untrusted or compromised subscriber-level accounts exist. The provided sources do not indicate unauthenticated exploitation.
Exploitation context
The CVE is not marked in CISA KEV, and the supplied sources do not claim active exploitation. Abuse requires an authenticated WordPress account with at least subscriber privileges, but the impact can include arbitrary post modification or deletion.
Researcher notes
Focus review on the plugin AJAX handlers for menu item modification and deletion. The key authorization flaw is object validation: a supplied post ID was not constrained to the expected menu item type before destructive or modifying actions.
Mitigation direction
- Upgrade Quick Restaurant Menu beyond 2.0.2 using official WordPress plugin guidance.
- Disable or remove the plugin until a fixed version is confirmed.
- Review subscriber and low-privilege accounts for unnecessary access.
- Restrict public registration if subscriber accounts are not business-required.
- Back up affected WordPress content before remediation.
Validation and detection
- Inventory WordPress sites for the Quick Restaurant Menu plugin.
- Confirm installed plugin versions are not 2.0.2 or older.
- Review logs for unexpected post edits or deletions by low-privilege users.
- Check WordPress users with subscriber-level or higher access.
- Validate content backups can restore modified or deleted posts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-0550 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/faa4fba5-cd19-4b96-aa09-07ed6d52a107?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.phpCVE reference
- https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2FtrunkCVE reference
- https://www.wordfence.com/blog/2023/02/multiple-vulnerabilities-patched-in-quick-restaurant-menu-plugin/CVE reference
- https://www.wordfence.com/threat-intel/vulnerabilities/id/faa4fba5-cd19-4b96-aa09-07ed6d52a107CVE reference · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.