The Five Star Restaurant Menu plugin for WordPress contains an unauthenticated broken access control flaw (CWE‑862) in versions 2.5.2 and earlier. The weakness allows any visitor to access privileged plugin functions without needing to authenticate. Attackers could modify menu settings, add or delete menu items, or otherwise tamper with the restaurant’s online menu content, potentially affecting business reputation and user experience.

The vulnerability affects the Rustaurius Five Star Restaurant Menu plugin for WordPress. All installations using version 2.5.2 or earlier are susceptible.

The flaw carries a CVSS score of 7.5, indicating a high severity. EPSS data is not available, and the issue has not been listed in CISA’s KEV catalog. Because the access control check is bypassed before authentication, a typical attack vector would involve interacting with the plugin’s administration or API endpoints directly as an anonymous user. No special setup or privileged account is required, so the risk of exploitation in exposed websites is high.