CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
Explanation of Vulnerability in Simple Terms
Five Star Restaurant Reservations versions before 2.7.23 contain an integrity vulnerability allowing network-based modification of data without authentication. An attacker can alter reservation records or other application data over the network. No user interaction is required. Update to version 2.7.23 or later to resolve this issue.
What an attacker can do
Modify reservation data or other application information without logging in.
Potential impact on your site
Attackers can alter restaurant reservations, customer details, or other critical booking data without credentials.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
