The FoodBook Lite WordPress plugin exposes an AJAX action named wp_ajax_nopriv_registration_action that accepts requests without any nonce verification or capability check. An attacker can invoke this endpoint and call wp_insert_user() to create a new account with a default 'customer' role. The plugin does not honor the WordPress users_can_register option, so even if site registration is disabled by the administrator, the action still allows account creation. This results in an unauthorized account that receives authentication cookies, effectively granting the attacker a legitimate user session and allowing further interaction with the site.

All releases of the FoodBook Lite plugin by themelooks up to and including version 1.5.6 are affected. The vulnerability resides in the class-components-ajax.php file, where the registration() method processes the AJAX request. Users who have installed the plugin on any WordPress site must verify their plugin version and contact the vendor for updates.

The CVSS score for this issue is 5.3, a moderate severity. The EPSS score of <1% indicates a very low probability of exploitation in real-world scenarios, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a web‑application exploit: a remote attacker can issue a crafted HTTP request to the wp_ajax endpoint and retrieve an authentication cookie. Because attackers can create accounts and receive authentication cookies, the vulnerability presents an immediate risk to the site's user base, enabling unauthorized access.