CVE-2026-15147

Deferred Deferred - Pending Action

Unauthenticated Payment Bypass in Five Star Restaurant Reservations

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-15147

Affected Vendors & Products

Vendor	Product	Version / Range
five_star_restaurant_reservations	five_star_restaurant_reservations	to 2.7.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Five Star Restaurant Reservations WordPress plugin before version 2.7.23. It allows unauthenticated attackers to manipulate payment notifications by not verifying the payment recipient, amount, or status. Attackers can mark arbitrary pending reservations as paid and confirmed without proper validation.

Detection Guidance

To detect this vulnerability, check if your Five Star Restaurant Reservations WordPress plugin is updated to version 2.7.23 or higher. Review payment notification logs for unauthorized changes to reservation statuses without proper validation. Inspect network traffic for unsecured payment callbacks to the plugin.

Impact Analysis

If you use this plugin, attackers could exploit it to create fake reservations marked as paid, leading to financial losses or operational disruptions. It may also allow unauthorized access to reservation data or enable further attacks on your WordPress site.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to reservation data, potentially violating data integrity requirements under GDPR or HIPAA. Unauthorized access or tampering with reservation records may lead to non-compliance with these regulations.

Mitigation Strategies

Update the Five Star Restaurant Reservations WordPress plugin to version 2.7.23 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-15147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70