EUVD-2026-39367
GHSA-x239-8vvh-363p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network-reachable handler with missing authorization gives AV:N/AC:L/PR:N/UI:N; impact is data modification only, so I:H with C:N and A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
AnalysisAI
Missing authorization in the Five Star Restaurant Reservations WordPress plugin (version 2.7.19 and earlier) lets remote unauthenticated attackers invoke protected plugin functionality and modify data without holding any account, per the CVSS PR:N vector. The flaw is a broken access control / missing capability check (CWE-862) reported by Patchstack, with a CVSS 3.1 base score of 7.5 driven entirely by integrity impact (C:N/I:H/A:N). No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The affected component is Five Star Restaurant Reservations (slug 'restaurant-reservations'), a WordPress plugin by Etoile Web Design that manages restaurant booking forms and reservation records on WordPress sites. The CPE 'cpe:2.3:a:etoile_web_design_incorporated:five_star_restaurant_reservations:*' confirms the affected software is the plugin itself across all builds up to and including 2.7.19. The root cause class is CWE-862 (Missing Authorization): one or more plugin actions (typically AJAX or admin-post handlers, or REST routes) execute privileged operations without verifying the caller's capabilities or a valid nonce. In WordPress plugins this commonly manifests when a handler omits current_user_can()/capability checks, so any visitor reaching the endpoint can trigger functions intended for authenticated operators.
RemediationAI
Upgrade the plugin to the latest available release above 2.7.19 from the WordPress plugin repository; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/restaurant-reservations/vulnerability/wordpress-five-star-restaurant-reservations-plugin-2-7-19-broken-access-control-vulnerability) for the confirmed fixed version, as no exact patched version was supplied in the input data. If you cannot update immediately, the most effective compensating control is a virtual patch / WAF rule (Patchstack and similar offer one) to block requests to the vulnerable plugin endpoint, accepting that overly broad rules may break legitimate booking submissions. As a stronger but more disruptive measure, deactivate the Five Star Restaurant Reservations plugin until patched - this removes the exposure entirely but takes the reservation feature offline. You can also restrict access to wp-admin/admin-ajax.php and the plugin's admin-post/REST routes at the reverse proxy for non-essential source IPs, which reduces attack surface but can interfere with front-end AJAX features.
Missing capability check on a WordPress AJAX action in Five Star Restaurant Reservations before 2.7.23 permits any user
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a
Information disclosure in the Five Star Restaurant Reservations WordPress plugin (versions up to and including 2.7.14) a
Rustaurius Five Star Restaurant Reservations through version 2.7.9 contains an authorization bypass vulnerability that a
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today