CVE-2026-15147

Name of the Vulnerable Software and Affected Versions Five Star Restaurant Reservations versions prior to 2.7.23

Description The plugin fails to verify the authenticity of incoming payment notifications. It does not validate the payment recipient, amount, and status, nor does it bind the notification to the intended booking. This is caused by an Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—due to missing validation on a user-controlled key. Consequently, unauthenticated attackers can bypass payments and mark arbitrary pending reservations as paid and confirmed.

Recommendations Update to version 2.7.23 or later.