Unauthenticated User Registration in FoodBook Lite WordPress Plugin

Executive Summary

CVE-2026-11802 is a vulnerability in the FoodBook Lite - Online Food Ordering System plugin for WordPress. The issue is classified as a Missing Authorization vulnerability, affecting all versions up to and including 1.5.6.

The vulnerability exists in the registration() function, which is accessible via the wp_ajax_nopriv_registration_action AJAX action. This function lacks proper security checks, including nonce verification, capability checks, and validation of the WordPress users_can_register option. As a result, unauthenticated attackers can create new user accounts with the 'customer' role and receive authentication cookies, even if the site administrator has disabled user registration.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your WordPress site, you can check if the FoodBook Lite plugin is installed and whether its version is up to or below 1.5.6. The vulnerability allows unauthenticated attackers to create user accounts even when registration is disabled.

• Check the installed version of the FoodBook Lite plugin via the WordPress admin dashboard under 'Plugins'. Look for the plugin name and version number.
• Verify if user registration is disabled in WordPress settings. Navigate to 'Settings' > 'General' and ensure the 'Anyone can register' option is unchecked.
• Inspect the site for unexpected user accounts with the 'customer' role. You can do this by navigating to 'Users' in the WordPress admin dashboard and reviewing the list of users.
• Use a security plugin or tool like Wordfence to scan for known vulnerabilities in the FoodBook Lite plugin. Wordfence can detect if the installed version is vulnerable.
• Check server logs for unusual AJAX requests to 'wp_ajax_nopriv_registration_action'. These requests may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using the affected WordPress plugin:

• Unauthorized account creation: Attackers can create new user accounts on your WordPress site without your knowledge or consent, even if you have disabled user registration.
• Privilege escalation risks: While the created accounts have the 'customer' role by default, they could potentially be used as a foothold for further attacks, such as exploiting other vulnerabilities to gain higher privileges.
• Data exposure: If your site handles sensitive customer data (e.g., order history, payment details), unauthorized accounts could access or manipulate this information, depending on the site's configuration.
• Reputation damage: Unauthorized accounts could be used to post spam, deface your site, or engage in malicious activities, harming your business's reputation.
• Compliance violations: If your site is subject to regulations like GDPR or HIPAA, unauthorized access to user data could lead to compliance violations and legal consequences.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with several common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): The vulnerability allows unauthorized account creation, which could lead to unauthorized access to personal data. Under GDPR, organizations must implement appropriate technical measures to protect personal data. Failure to do so could result in non-compliance, leading to fines and legal action. Additionally, if unauthorized access results in a data breach, you may be required to report it to authorities and affected individuals.
• HIPAA (Health Insurance Portability and Accountability Act): If your WordPress site handles protected health information (PHI) and is subject to HIPAA, this vulnerability could lead to unauthorized access to PHI. HIPAA requires covered entities to implement safeguards to protect PHI, and a breach could result in significant penalties.
• PCI DSS (Payment Card Industry Data Security Standard): If your site processes payment card information, unauthorized account creation could lead to unauthorized access to cardholder data. PCI DSS requires strict access controls, and this vulnerability could violate those requirements, leading to non-compliance and potential fines.
• Other regulations: Depending on your industry and location, other regulations (e.g., CCPA, PIPEDA) may also be impacted. Unauthorized access to user data could violate requirements for data protection, access controls, and breach notification.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Update the FoodBook Lite plugin to the latest version if a patched version is available. This is the most effective way to resolve the issue.
• If no update is available, disable the FoodBook Lite plugin temporarily until a patch is released. This will prevent exploitation of the vulnerability.
• Manually review and remove any unauthorized user accounts with the 'customer' role. Navigate to 'Users' in the WordPress admin dashboard and delete suspicious accounts.
• Enable a Web Application Firewall (WAF) like Wordfence or Cloudflare to block malicious requests targeting the vulnerable AJAX action.
• Monitor your site for any unusual activity, such as unexpected user registrations or unauthorized logins.
• Consider implementing additional security measures, such as limiting access to the WordPress admin dashboard and enabling two-factor authentication for user accounts.

Useful 0 Not Useful 0