CVE-2026-0658 Five Star Restaurant Reservations < 2.7.9 - Arbitrary Bookings Deletion via CSRF
Attackers can trick logged-in admins into deleting restaurant bookings via CSRF due to missing checks in bulk actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-0658?
CVE-2026-0658 is a medium-severity vulnerability in Unknown Five Star Restaurant Reservations, published on 2 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting bookings via CSRF attacks.
Weakness: CWE-352
Which versions are affected by CVE-2026-0658?
How do I fix CVE-2026-0658?
No fix has been published for CVE-2026-0658 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-0658 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-0658 exists.
Sources
Also known as GHSA-xmx6-mr5x-2rqc.