CVE-2025-63078: Broken Access Control in Restaurant Menu by MotoPress

Technical summary

CVE-2025-63078 is a CWE-862 (Missing Authorization) vulnerability in Restaurant Menu by MotoPress up to version 2.4.11. The vulnerability stems from insufficient access control checks when subscribers interact with menu management endpoints. The plugin fails to properly validate whether an authenticated user has the necessary role or capability to perform menu modification operations, allowing privilege escalation within the application. The attack vector is network-based and requires valid subscriber credentials; no user interaction is needed to exploit the vulnerability.

Business impact

For restaurant operators relying on Restaurant Menu by MotoPress, this vulnerability poses a risk to menu data integrity. A disgruntled employee or compromised subscriber account could maliciously alter menu pricing, item descriptions, or availability status, leading to customer confusion, lost revenue, or reputational damage. The impact is contained to data modification rather than data theft or system availability, but menu accuracy is critical to restaurant operations and customer trust.

Affected systems

Restaurant Menu by MotoPress versions 2.4.11 and earlier are affected. Organizations using this WordPress plugin for restaurant menu management should verify their installed version. The vulnerability requires an attacker to possess a valid subscriber-level account on the WordPress installation, making it most relevant in multi-user WordPress environments where subscriber access is broadly granted.

Exploitability

Exploitability is moderate. While the attack has a low complexity and requires only network access and valid subscriber credentials, it does require authentication—meaning random internet users cannot exploit it without account access. Organizations with strong account management practices and restricted subscriber roles will face lower risk. However, in environments where subscriber accounts are commonly issued or shared, the risk increases substantially.

Remediation

Upgrade Restaurant Menu by MotoPress to a patched version above 2.4.11. Verify the specific patched version number against the official MotoPress plugin repository or vendor advisory. As a temporary control, restrict subscriber role access to the plugin's menu management features through WordPress capability management or role-limiting plugins until patching is feasible.

Patch guidance

Check the WordPress plugin repository or MotoPress's official website for available updates. Upgrade through the WordPress admin dashboard or manually deploy the latest version. Test the update in a staging environment first to ensure compatibility with your menu data and any custom configurations. Verify that the patched version properly enforces access controls by confirming that subscriber accounts can no longer modify menu items.

Detection guidance

Monitor WordPress admin activity logs for unusual menu modification events attributed to subscriber-level accounts. Review plugin versions in use across your WordPress installations via automated WordPress vulnerability scanners or manual audits. Check for POST requests to menu management endpoints originating from subscriber accounts in web server logs. Enable WordPress security plugins that track and alert on unauthorized capability usage.

Why prioritize this

This vulnerability merits prompt attention but not emergency-level response. The CVSS score of 4.3 (Medium) reflects the requirement for authentication, but the integrity impact on critical business data (menu information) justifies moving it ahead of low-severity issues. Prioritize patching if your subscriber user base is large or if menu integrity is audited for compliance reasons. In smaller deployments with tightly controlled subscriber access, this can be addressed in a regular maintenance cycle.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability with low attack complexity but a requirement for prior authentication (PR:L). The vector shows no confidentiality impact, limited integrity impact on restaurant menu data (I:L), and no availability impact. The score appropriately captures that this is not a critical remote unauthenticated attack, but rather a privilege escalation affecting data modification rights within an authenticated scope.

Frequently asked questions