The vulnerability in the Restaurant Menu by MotoPress plugin allows a user with subscriber permissions to perform actions that should be restricted, exposing sensitive menu data or permitting unauthorized modifications. This broken access control is categorized as CWE‑862 and can undermine data confidentiality and integrity within a WordPress site.

All versions of the Restaurant Menu by MotoPress plugin up to and including 2.4.11 are affected. The plugin is distributed by jetmonsters and is commonly used to manage restaurant menus on WordPress sites.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. Expl attacker must log in and obtain subscriber-level access before leveraging the flaw. Given the limited scope and the need for valid credentials, the likelihood of widespread exploitation remains moderate, but sites with compromised subscriber accounts pose a real risk.