Auth bypass in Five Star Restaurant Reservations
CVE-2026-15147
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
EPSS: 0.001 (2.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Unknown Five Star Restaurant Reservations — versions 0
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-15147?
- CVE-2026-15147 is a medium-severity vulnerability in Five Star Restaurant Reservations, classified under Insufficient Verification of Data Authenticity. CVSS score: 5.3/10. Published 2026-08-06.
- How severe is CVE-2026-15147?
- Medium severity. CVSS v3 base score is 5.3 out of 10.