Description

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:47.450Z",
  "pubdate": "2026-08-06T22:16:47.450Z",
  "executiveSummary": "The Five Star Restaurant Reservations WordPress plugin before 2.7.23 suffers from a critical payment notification verification vulnerability.\nThe vulnerability stems from a failure to authenticate and validate incoming payment notifications, specifically lacking validation of the payment recipient, transaction amount, payment status, and cryptographic or logical binding to the intended booking record.\nUnauthenticated remote attackers can exploit this flaw by sending crafted, arbitrary payment notification payloads directly to the plugin's notification endpoint.\nSuccessful exploitation allows malicious actors to manipulate reservation states, automatically transitioning arbitrary pending reservations to 'paid' and 'confirmed' status without executing any legitimate financial transaction.\nThe business impact includes severe operational disruption, potential fraud, unauthorized service provisioning, and compromised reservation integrity.\nNo elevated privileges or prior authentication are required to execute the attack, making it accessible to any external network adversary capable of interacting with the target WordPress instance.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure handling of asynchronous payment notifications or webhook callbacks within the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23.\nSpecifically, the component responsible for processing payment gateway callbacks fails to implement proper cryptographic signature verification, source IP validation, or session-to-transaction correlation.\nFurthermore, the logic omits critical validation checks against the transaction payload, failing to verify that the payment recipient matches the merchant account, that the transaction amount corresponds to the specific booking cost, and that the payment status is explicitly marked as successful.\nThe affected component is exposed directly to the network via an unauthenticated HTTP endpoint or webhook listener utilized by the plugin.\nBecause the input parameters within incoming notifications are blindly trusted and processed without integrity checks or robust state binding, an unauthenticated attacker can craft synthetic HTTP requests mimicking legitimate payment gateway notifications.\nThe attack flow proceeds as follows: First, the attacker identifies a pending reservation identifier or enumerates valid booking IDs within the target system. Second, the attacker formulates a forged payment notification payload containing the targeted reservation ID alongside arbitrary success parameters. Third, the attacker transmits this HTTP request across the network to the plugin's payment notification handler. Fourth, the vulnerable backend logic processes the payload, bypasses security checks due to the absence of verification logic, and updates the database record. Finally, the target reservation is marked as paid and confirmed, granting the attacker unauthorized confirmation of restaurant services without rendering payment.\nThe affected software versions include all installations of the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23."
}