CVE-2026-15147

Received Received - Intake

Unauthenticated Payment Bypass in Five Star Restaurant Reservations

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-15147

Affected Vendors & Products

Vendor	Product	Version / Range
five_star_restaurant_reservations	five_star_restaurant_reservations	to 2.7.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Five Star Restaurant Reservations WordPress plugin before version 2.7.23. It allows unauthenticated attackers to manipulate payment notifications by not verifying the payment recipient, amount, or status. Attackers can mark arbitrary pending reservations as paid and confirmed without proper validation.

Impact Analysis

If you use this plugin, attackers could exploit it to create fake reservations marked as paid, leading to financial losses or operational disruptions. It may also allow unauthorized access to reservation data or enable further attacks on your WordPress site.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to reservation data, potentially violating data integrity requirements under GDPR or HIPAA. Unauthorized access or tampering with reservation records may lead to non-compliance with these regulations.

Mitigation Strategies

Update the Five Star Restaurant Reservations WordPress plugin to version 2.7.23 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-15147. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70