CVE-2026-42670: WordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability

Synopsis

An authorization bypass vulnerability exists in the Five Star Restaurant Reservations WordPress plugin, affecting all versions through 2.7.14. The flaw is reachable over the network with no authentication required, meaning any remote visitor can send a crafted request to the affected endpoint. Successful exploitation allows an attacker to read protected reservation or payment data without going through the intended authorization checks. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress instance to exploit it.

• AuthenticationNot required

  No account or session credential of any kind is needed; the vulnerability is exploitable by any unauthenticated remote party.

• Victim interactionNot required

  The attacker sends a direct request to the affected endpoint and does not need any user to take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental setup.

Blast Radius

• An attacker can read reservation records, which may include guest names, contact details, party size, and booking times.
• Payment-related data stored or referenced in the plugin's reservation flow is exposed, which may include transaction identifiers or payment status fields.
• No write access or service disruption is implied by this vulnerability; the attacker gains read access only.