CVE-2020-29045
📋 TL;DR
CVE-2020-29045 is a critical remote code execution vulnerability in the Food and Drink Menu WordPress plugin. Attackers can execute arbitrary code by sending a maliciously crafted cookie to vulnerable WordPress sites. Any WordPress site using this plugin version 2.2.0 or earlier is affected.
💻 Affected Systems
- Food and Drink Menu WordPress Plugin
📦 What is this software?
Five Star Restaurant Menu by Fivestarplugins
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary code, install backdoors, steal data, deface websites, or pivot to internal networks.
Likely Case
Website defacement, data theft, cryptocurrency mining malware installation, or use as part of a botnet.
If Mitigated
Attack blocked at web application firewall level or plugin disabled before exploitation.
🎯 Exploit Status
Exploitation requires sending a specially crafted cookie. Multiple public exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.2.1 or later
Vendor Advisory: https://wordpress.org/plugins/food-and-drink-menu/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find Food and Drink Menu plugin. 4. Click Update Now to update to version 2.2.1 or later. 5. Verify update completed successfully.
🔧 Temporary Workarounds
Disable the plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate food-and-drink-menu
Web Application Firewall rule
allBlock malicious cookie patterns at WAF level
Add rule to block requests containing 'fdm_cart' cookie with serialized PHP object patterns
🧯 If You Can't Patch
- Disable the Food and Drink Menu plugin immediately
- Implement strict WAF rules to block requests with fdm_cart cookie containing serialized objects
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Food and Drink Menu. If version is 2.2.0 or earlier, you are vulnerable.Check Version:
wp plugin get food-and-drink-menu --field=versionVerify Fix Applied:
Verify plugin version is 2.2.1 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Web server logs showing POST/GET requests with fdm_cart cookie containing serialized PHP objects
- WordPress error logs showing unserialize errors
Network Indicators:
- HTTP requests containing fdm_cart cookie with base64 encoded or serialized data
- Unusual outbound connections from web server after exploitation
SIEM Query:
source="web_server_logs" AND (fdm_cart AND (O: OR s: OR a: OR i: OR d:))