CVE-2026-11802— FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action
Possible ATT&CK Techniques 1AI
T1136.001 · Local AccountAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| themelooks | FoodBook Lite – Online Food Ordering System | ≤ 1.5.6 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11802
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action
Source: NVD (National Vulnerability Database)
Vulnerability Description
The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress FoodBook Lite – Online Food Ordering System 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress FoodBook Lite – Online Food Ordering System是WordPress基金会的一款在线食物订购系统。 WordPress FoodBook Lite – Online Food Ordering System 1.5.6及之前版本存在授权问题漏洞，该漏洞源于授权缺失问题，在wp_ajax_nopriv_registration_action AJAX动作中，registration()函数缺乏nonce验证或能力检查，且在调用wp_insert_us
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| themelooks | FoodBook Lite – Online Food Ordering System | 0 ~ 1.5.6 | - |
II. Public POCs for CVE-2026-11802
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11802
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-11802 (5)
Vendor Advisories for CVE-2026-11802 (1)
Vendor Pages for CVE-2026-11802 (1)
IV. Related Vulnerabilities
Same vendor: themelooks
- CVE-2026-25014
WordPress Enter Addons plugin <= 2.3.2 - Cross Site Request - CVE-2025-8687
Enter Addons <= 2.2.7 - Authenticated (Contributor+) Stored - CVE-2025-60125
WordPress FoodBook Plugin <= 4.7.6 - Sensitive Data Exposure - CVE-2025-31847
WordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting - CVE-2024-56252
WordPress Enter Addons plugin <= 2.1.9 - Cross Site Scriptin
Same weakness: CWE-862
- CVE-2026-64622
Network-AI 5.12.2 through 5.13.3 Missing Authorization via A - CVE-2026-63758
SurrealDB before 3.1.0 Authorization Bypass via KILL Stateme - CVE-2026-63741
SurrealDB before 3.1.0 Authentication Bypass via USE stateme - CVE-2026-16215
geex-arts django-jet OAuth Credential Revoke authorization - CVE-2026-16197
Sipeed PicoClaw Group Message feishu_64.go handleMessageRece
V. Comments for CVE-2026-11802
No comments yet