What’s Vulnerable › Vulnerabilities
CVE-2026-15147: Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-06 · updated 2026-08-26
- Weakness: CWE-345
Description
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
Affected products
- Five Star Restaurant Reservations: before 2.7.23 — fixed in 2.7.23
How to fix
Upgrade to a fixed version: Five Star Restaurant Reservations 2.7.23. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15147 or the next vulnerability affects your stack