Wordpress Plugin
CVE-2025-68601
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.8.
AnalysisAI
Cross-Site Request Forgery (CSRF) in Five Star Restaurant Reservations WordPress plugin versions ≤2.7.8 enables unauthenticated attackers to perform unauthorized administrative actions through social engineering. With CVSS 8.8 (High), the vulnerability requires no privileges and low attack complexity, though user interaction is necessary. EPSS probability is minimal (0.02%, 6th percentile), indicating low observed exploitation likelihood despite the high CVSS score. No confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis.
Technical ContextAI
Cross-Site Request Forgery (CWE-352) is a web security vulnerability that forces authenticated users to execute unwanted actions on web applications where they are currently authenticated. The Five Star Restaurant Reservations WordPress plugin (restaurant-reservations) lacks proper CSRF token validation on state-changing operations through version 2.7.8. WordPress plugins commonly implement CSRF protection using nonce tokens (wp_nonce_field/wp_verify_nonce functions). Absence or improper implementation of these protections allows attackers to craft malicious requests that exploit the victim's authenticated session. In restaurant reservation systems, CSRF vulnerabilities typically affect administrative functions such as booking modifications, settings changes, customer data manipulation, or plugin configuration alterations.
Affected ProductsAI
The vulnerability affects the Five Star Restaurant Reservations plugin (restaurant-reservations) for WordPress, impacting all versions from the earliest release through version 2.7.8 inclusive. This plugin is developed by Rustaurius and provides table booking and reservation management functionality for restaurant websites. The vulnerability was reported through Patchstack's audit process (audit@patchstack.com). Site administrators running any version up to and including 2.7.8 should consider their installations vulnerable to CSRF attacks targeting administrative functions. The Patchstack database entry provides additional technical details at https://patchstack.com/database/Wordpress/Plugin/restaurant-reservations/vulnerability/wordpress-five-star-restaurant-reservations-plugin-2-7-7-cross-site-request-forgery-csrf-vulnerability.
RemediationAI
Site administrators should upgrade the Five Star Restaurant Reservations plugin to the latest available version beyond 2.7.8 as vendor-released patches typically address reported CSRF vulnerabilities through proper nonce implementation. Verify the current plugin version in the WordPress admin dashboard under Plugins and update through the standard WordPress update mechanism. Until patching is completed, implement defense-in-depth measures including restricting administrative access to trusted IP addresses via .htaccess or firewall rules, enforcing security awareness training for administrative users about not clicking untrusted links while authenticated, and reviewing WordPress audit logs for suspicious reservation or configuration changes. Consider temporarily restricting plugin functionality to essential operations only if administrative actions can be deferred. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/restaurant-reservations/vulnerability/wordpress-five-star-restaurant-reservations-plugin-2-7-7-cross-site-request-forgery-csrf-vulnerability for specific remediation guidance and verification steps.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today