EUVD-2026-92585
GHSA-r9cf-5qq5-hv9r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-facing WordPress plugin endpoint (AV:N/AC:L/PR:N/UI:N) disclosing sensitive data, so C:H with no integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24.
Articles & Coverage 1
AnalysisAI
Unauthenticated information disclosure in Five Star Restaurant Reservations (plugin versions through 2.7.24) allows remote attackers to extract embedded sensitive data from WordPress sites. The vulnerability, tracked as CWE-201, has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), indicating high confidentiality impact with no integrity or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable against any WordPress installation running the Five Star Restaurant Reservations plugin (slug restaurant-reservations) from an unspecified initial version through 2.7.24, in its default configuration - no authentication (PR:N) and no user interaction (UI:N) are required per the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) indicates a network-exploitable, unauthenticated, low-complexity information-disclosure flaw with high confidentiality impact but no integrity or availability impact, consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable the Five Star Restaurant Reservations plugin (versions through 2.7.24) on all WordPress sites if it is not business-critical; if it must remain active, deploy WAF rules to block unauthenticated requests to reservation endpoints and restrict access via IP allowlisting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing capability check on a WordPress AJAX action in Five Star Restaurant Reservations before 2.7.23 permits any user
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a
Missing authorization in the Five Star Restaurant Reservations WordPress plugin (version 2.7.19 and earlier) lets remote
Information disclosure in the Five Star Restaurant Reservations WordPress plugin (versions up to and including 2.7.14) a
Rustaurius Five Star Restaurant Reservations through version 2.7.9 contains an authorization bypass vulnerability that a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today