The WordPress Food Menu plugin versions before 6.0.2 allow attackers to alter the status of any reservation without authentication or ownership checks. The modification endpoint is exposed to unauthenticated users and is protected only by a nonce that is publicly available to all site visitors. As a result, an attacker could mark reservations as confirmed, completed, or canceled at will, potentially disrupting business operations, customer service, and financial processing. The flaw represents a classic missing authorization check, permitting arbitrary state changes to sensitive reservation data.

The vulnerability affects installations of the Food Menu plugin for WordPress with versions earlier than 6.0.2. No specific vendor or deeper version detail is supplied beyond the < 6.0.2 boundary, so any site using an older release of the plugin is potentially vulnerable.

The CVSS score is not provided in the public data, and EPSS scores are unavailable, making it difficult to quantify the expected exploitation likelihood precisely. Because the flaw enables complete reservation status manipulation without needing any credentials, the potential impact is high. The vulnerability is not listed in CISA’s KEV catalog. While the attack vector is inferred to be remote over the public web through the reservation status endpoint, the concrete conditions for exploitation require that the endpoint is reachable and that an attacker can guess or compute the required nonce parameters, which may be trivial if a non‑encrypted public nonce is used.