CVE-2024-13792 is a high severity (CVSS 7.3) arbitrary shortcode execution flaw in the WooCommerce Food restaurant menu and ordering plugin for WordPress, in versions up to and including 3.3.2. Unauthenticated attackers can run shortcodes. Update past 3.3.2. Confirm the fixed release in the vendor changelog.
What's affected
- WooCommerce Food, Restaurant Menu and Food ordering plugin, all versions up to and including 3.3.2.
The record does not name a fixed version. The plugin is sold on CodeCanyon, so check the item page and changelog for a release newer than 3.3.2.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i food
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Update to a release newer than 3.3.2.
- List the shortcodes registered on your site and remove plugins you do not use.
- Check the plugin's license so you receive updates.
- Look up CVE-2024-13792 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record says an action does not validate a value before calling do_shortcode. A visitor can then pick which of the site's shortcodes runs. On a restaurant ordering site, shortcodes from the order and payment plugins may be present, so the practical effect depends on that mix.
The same wording appears in records for Avada and PressMart.
This CVE is an arbitrary shortcode execution flaw (CWE-94, Code Injection). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
WordPress shortcodes are small tags that expand into code-driven content. Running do_shortcode on a value that a visitor supplied means the visitor decides which shortcode runs, from every shortcode registered on the site.
The real impact depends on what is installed. Some shortcodes only print text. Others read data, query the database or change state. The weakness is classed as code injection because the input steers which code executes. The right fix is to validate the value against a fixed list before it reaches do_shortcode, and to avoid exposing the action to unauthenticated users at all.
Quick check
Is a login needed?
No. The record says unauthenticated attackers can exploit it.
Are other plugins affected?
Several have similar flaws, such as Avada Builder, CVE-2024-13345.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
