CVE-2026-15147 Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR
Unauthenticated attackers can bypass payment validation to confirm arbitrary restaurant reservations, affecting users of the Five Star Restaurant Reservations plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15147?
CVE-2026-15147 is a medium-severity vulnerability in Unknown Five Star Restaurant Reservations, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
Which versions are affected by CVE-2026-15147?
How do I fix CVE-2026-15147?
No fix has been published for CVE-2026-15147 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-15147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15147 exists.
Sources
Also known as GHSA-4prh-qcrv-cpfg.