CVE-2026-15147
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking. This allows unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
Risk Assessment
Attackers can falsely confirm reservations without payment, leading to financial losses and disruption of restaurant operations.
Recommendation
Update the Five Star Restaurant Reservations plugin to version 2.7.23 or later to ensure payment notification verification.
Other vulnerabilities in Five Star Restaurant Reservations
See all- CVE-2026-54830High
The Five Star Restaurant Reservations plugin version 2.7.19 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to reservation functions without required authentication.
- CVE-2026-42670High
Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.
Original NVD description (English source)
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.