5.3
Medium
CVE-2026-15147 The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming…
Description
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Five Star Restaurant Reservations 2.7 | earliest → < 2.7.23 | 2.7.23 |
Other CVEs of Five Star Restaurant Reservations
The 4 CVEs of Five Star Restaurant Reservations →
CVE-2026-15151
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of…
7.5
High
CVE-2026-0658
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions,…
4.3
Medium
CVE-2022-0421
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a…
6.1
Medium