The Easy restaurant menu manager plugin is affected by a CSRF flaw that allows an unauthenticated attacker, who has convinced an administrator to follow a crafted link, to upload a menu file. The missing or incorrect nonce validation in the nsc_eprm_save_menu function means the system trusts the request and processes the file, potentially exposing the site to harmful content or unauthorized changes to the menu.

Vendors: nikelschubert. Product: Easy restaurant menu manager plugin for WordPress, versions up to and including 2.0.2 are impacted. Administrators using these populations are vulnerable until they upgrade beyond 2.0.2.

The CVSS score of 4.3 reflects a moderate severity, while an EPSS score below 1% indicates low likelihood of widespread exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the vulnerability by sending a forged request to the site that a logged‑in administrator will automatically process when clicking a link; the query relies on the absence of proper nonce checks.