[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy3Hxl2-6FKdfAfBb7yTsf8UTV1l2CGaXRMhW4jXiaFw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-11802","foodbook-lite-missing-authorization-to-unauthenticated-user-registration-via-registrationaction-ajax-action","FoodBook Lite \u003C= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action","The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.","foodbook-light-online-food-ordering-system",null,"\u003C=1.5.6","1.5.7","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-13 13:10:51","2026-07-14 01:30:02",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8b67557c-785f-433b-8e5b-fcc0bda14892?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002Fadmin.php","admin\u002Finc\u002Fadmin-template.php","admin\u002Finc\u002Fclass-admin-menu.php","assets\u002Fjs\u002Ffoodbooklite.js","foodbook-lite.php","foodbooklite-init.php","inc\u002FAPI.php","inc\u002FAdmin_API.php","researched",false,3,"I cannot fulfill this request. I am prohibited from generating functional exploitation plans, actionable payloads, or specific instructions for attacking software, including WordPress plugins, even for research or educational purposes.\n\nHowever, I can explain the technical mechanics of the vulnerability type described (Missing Authorization in AJAX handlers) and the standard defensive measures for WordPress developers to prevent such issues.\n\n### Vulnerability Mechanics: Missing Authorization in WordPress AJAX\n\nThe vulnerability described in CVE-2026-11802 is a common class of security flaw in WordPress where an AJAX entry point (hooked via `wp_ajax_nopriv_*`) fails to implement necessary security checks before performing sensitive operations.\n\nIn WordPress, `wp_ajax_nopriv_{action}` hooks are intended for functionality accessible to unauthenticated users. When these handlers perform actions like user creation, database modification, or sensitive data retrieval, they must implement several layers of defense:\n\n1.  **Global Settings Check:** For registration functionality, the code should verify if the site actually allows registration by checking `get_option('users_can_register')`.\n2.  **Nonce Verification:** Nonces (Number used ONCE) protect against Cross-Site Request Forgery (CSRF). A handler should verify a nonce sent from the client using `check_ajax_referer()` or `wp_verify_nonce()`.\n3.  **Capability Checks:** Even if the action is unauthenticated, the code must ensure the requested operation doesn't inadvertently grant higher-than-intended privileges.\n4.  **Input Sanitization\u002FValidation:** All user-supplied data must be sanitized (e.g., `sanitize_text_field()`, `sanitize_email()`) and validated before being passed to sinks like `wp_insert_user()`.\n\nWithout these checks, an attacker can directly interact with the `admin-ajax.php` endpoint, providing the expected `action` parameter and any required user data to trigger the vulnerable function.\n\n### Defensive Remediation and Secure Coding\n\nTo secure a WordPress AJAX registration handler, developers should follow this pattern:\n\n```php\npublic function secure_registration_handler() {\n    \u002F\u002F 1. Check if registration is enabled site-wide\n    if ( ! get_option( 'users_can_register' ) ) {\n        wp_send_json_error( [ 'message' => 'Registration is disabled.' ], 403 );\n    }\n\n    \u002F\u002F 2. Verify Nonce (CSRF protection)\n    \u002F\u002F The nonce should have been generated via wp_create_nonce('my_registration_action')\n    if ( ! check_ajax_referer( 'my_registration_action', 'security', false ) ) {\n        wp_send_json_error( [ 'message' => 'Invalid security token.' ], 403 );\n    }\n\n    \u002F\u002F 3. Sanitize and Validate Input\n    $user_email = sanitize_email( $_POST['email'] );\n    $user_login = sanitize_user( $_POST['username'] );\n\n    if ( ! is_email( $user_email ) ) {\n        wp_send_json_error( [ 'message' => 'Invalid email address.' ] );\n    }\n\n    \u002F\u002F 4. Perform the operation using WordPress API\n    $user_id = wp_insert_user( [\n        'user_login' => $user_login,\n        'user_email' => $user_email,\n        'role'       => 'customer', \u002F\u002F Explicitly define the lowest necessary role\n    ] );\n\n    if ( is_wp_error( $user_id ) ) {\n        wp_send_json_error( [ 'message' => $user_id->get_error_message() ] );\n    }\n\n    wp_send_json_success( [ 'message' => 'Registration successful.' ] );\n}\n```\n\nFor further information on securing WordPress plugins, I recommend consulting the [WordPress Plugin Handbook's Security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP Top Ten project](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F).","The FoodBook Lite plugin for WordPress allows unauthenticated user registration through the 'registration_action' AJAX handler without verifying if registration is enabled in the site settings. The handler also lacks nonce verification, allowing attackers to programmatically create new accounts with the 'customer' role even when registration is disabled by the administrator.","\u002F\u002F inc\u002Fclass-components-ajax.php line 67\n  public function registration() {\n\n    $formData = isset( $_POST['data'] ) ? $_POST['data'] : '';\n\n    $parms = [];\n\n    parse_str( $formData, $parms );\n\n\n    $new_user_login = stripcslashes( $parms['username'] );\n    $new_user_email = stripcslashes( $parms['useremail'] );\n    $new_user_password = $parms['password'];\n\n    $user_data = array(\n        'user_login' => $new_user_login,\n        'user_email' => $new_user_email,\n        'user_pass'  => $new_user_password,\n        'role'       => 'customer'\n    );\n\n    $user_id = wp_insert_user( $user_data );\n\n    if ( ! is_wp_error( $user_id ) ) {\n\n        wp_set_current_user( $user_id );\n        wp_set_auth_cookie( $user_id );\n\n        $status = [ 'loggedin' => true, 'user_id' => $user_id, 'message' => esc_html__('Wrong username or password.', 'foodbooklite' ) ];\n\n      } else {\n\n        $status = [ 'loggedin' => false, 'message' => $user_id->get_error_message() ];\n\n      }\n\n      wp_send_json( $status );\n\n      wp_die();\n\n  }","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffoodbook-light-online-food-ordering-system\u002F1.5.6\u002Finc\u002Fclass-components-ajax.php\t2026-05-21 14:34:18.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Ffoodbook-light-online-food-ordering-system\u002F1.5.7\u002Finc\u002Fclass-components-ajax.php\t2026-06-24 13:39:40.000000000 +0000\n@@ -65,16 +66,28 @@\n \n   public function registration() {\n \n-    $formData = isset( $_POST['data'] ) ? $_POST['data'] : '';\n+    \u002F\u002F Verify the request originated from our frontend (CSRF protection).\n+    foodbooklite_verify_ajax_nonce();\n+\n+    \u002F\u002F Respect the site's \"anyone can register\" setting.\n+    if ( ! get_option( 'users_can_register' ) ) {\n+        wp_send_json_success( [ 'loggedin' => false, 'message' => esc_html__( 'User registration is currently disabled.', 'foodbooklite' ) ] );\n+    }\n+\n+    $formData = isset( $_POST['data'] ) ? wp_unslash( $_POST['data'] ) : '';\n \n     $parms = [];\n \n     parse_str( $formData, $parms );\n \n \n-    $new_user_login = stripcslashes( $parms['username'] );\n-    $new_user_email = stripcslashes( $parms['useremail'] );\n-    $new_user_password = $parms['password'];\n+    $new_user_login = isset( $parms['username'] ) ? sanitize_user( $parms['username'] ) : '';\n+    $new_user_email = isset( $parms['useremail'] ) ? sanitize_email( $parms['useremail'] ) : '';\n+    $new_user_password = isset( $parms['password'] ) ? $parms['password'] : ''; \u002F\u002F password must stay raw\n+\n+    if ( empty( $new_user_login ) || ! is_email( $new_user_email ) ) {\n+        wp_send_json_success( [ 'loggedin' => false, 'message' => esc_html__( 'A valid user name and email are required.', 'foodbooklite' ) ] );\n+    }\n \n     $user_data = array(\n         'user_login' => $new_user_login,","An unauthenticated attacker can exploit this vulnerability by sending a POST request to the WordPress AJAX endpoint (admin-ajax.php). The request must include the 'action' parameter set to 'registration_action' and a 'data' parameter containing a URL-encoded string with the desired registration details (username, useremail, and password). Because the registration() function fails to check the WordPress 'users_can_register' option and lacks CSRF nonces, the plugin will execute wp_insert_user() to create a new user with the 'customer' role. Upon successful creation, the server responds with authentication cookies for the new user, granting the attacker immediate access.","gemini-3-flash-preview","2026-07-15 07:52:14","2026-07-15 07:52:51",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.5.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffoodbook-light-online-food-ordering-system\u002Ftags\u002F1.5.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffoodbook-light-online-food-ordering-system.1.5.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffoodbook-light-online-food-ordering-system\u002Ftags\u002F1.5.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Ffoodbook-light-online-food-ordering-system.1.5.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffoodbook-light-online-food-ordering-system\u002Ftags"]