EUVD-2026-54196
GHSA-4prh-qcrv-cpfg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable webhook endpoint requires no credentials or user interaction; impact is limited to integrity of reservation status with no confidentiality or availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
AnalysisAI
Unauthenticated payment notification forgery in the Five Star Restaurant Reservations WordPress plugin (all versions before 2.7.23) enables remote attackers to fraudulently mark arbitrary pending reservations as paid and confirmed without completing actual payment. The plugin's payment webhook handler accepts incoming IPN-style callbacks without verifying the notification's cryptographic authenticity, recipient identity, payment amount, transaction status, or binding to a specific booking - every control that prevents payment bypass is absent. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the attack is network-accessible, requires zero privileges and zero user interaction, making it accessible to unsophisticated actors.
Technical ContextAI
The Five Star Restaurant Reservations plugin integrates with payment processors that use Instant Payment Notification (IPN) or webhook callbacks to signal completed transactions. Secure implementations must validate the notification source via HMAC signature or shared secret, confirm that the payment amount matches the booking total, verify the merchant recipient, and bind the notification to a specific booking identifier to prevent replay or cross-booking abuse. This plugin omits all such controls. The root cause class aligns with CWE-345 (Insufficient Verification of Data Authenticity) - external input in the form of a payment notification is accepted and acted upon without any cryptographic or logical verification. The ENISA EUVD identifier EUVD-2026-54196 independently corroborates the scope. No formal CPE string was included in available intelligence, but the affected range spans all plugin releases from version 0 through 2.7.22 as reported by WPScan and EUVD. The tag 'Information Disclosure' applied by the reporting source appears to be a misclassification; the CVSS vector (C:N/I:L/A:N) confirms the actual impact is integrity violation, not data exposure.
RemediationAI
Update the Five Star Restaurant Reservations plugin to version 2.7.23 or later, available from the WordPress plugin repository. A vendor-released patch is confirmed available per the WPScan advisory at wpscan.com/vulnerability/9cfa5856-3c30-451d-895e-3d68208d834d. If immediate patching is not feasible, consider disabling the payment notification endpoint at the web server or WAF level - note this will require manual payment confirmation by administrators until patching is complete, adding operational overhead. If the plugin relies on a specific payment gateway with a documented IP range for IPN callbacks, restricting the notification endpoint to those source IPs at the firewall level is a targeted compensating control, though this may break payment flows if the processor's IP range changes. Operators should audit reservation records for any pending-to-paid status transitions occurring without corresponding payment gateway records in their payment processor dashboard, as such anomalies would indicate exploitation attempts.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today