# Five Star Restaurant Menu <= 2.6.1 - Unauthenticated Insecure Direct Object Reference to Order Status Disclosure via 'order_id' Parameter

- **ID:** WPSEC-2026-1547
- **Plugin:** Five Star Restaurant Menu and Food Ordering (`food-and-drink-menu`), https://wordpress.org/plugins/food-and-drink-menu/
- **Affected versions:** all versions before 2.7.0
- **Fixed in:** 2.7.0 (Update to 2.7.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/food-and-drink-menu
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1547/

## Description

The Five Star Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the 'fdm_update_order_progress' AJAX action in all versions up to, and including, 2.6.1. The action is available to unauthenticated users and returns get_post_status() for any supplied post ID. It does not check that the post is an order or that the order belongs to the requester. This makes it possible for unauthenticated attackers to read the status of arbitrary orders and the status of any other post, such as draft, private or trashed.

## References

- https://wpsec.com/vuln/WPSEC-2026-1547/
- https://plugins.svn.wordpress.org/food-and-drink-menu/tags/2.7.0/
- https://wordpress.org/plugins/food-and-drink-menu/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1547/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.