CVE-2025-68044CWE-639

CVE-2025-68044

High · published January 5, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

⚡ A crafty little misstep in access control lets users take advantage of improperly configured security levels! Imagine a restaurant where anyone can stroll past the waitlist and claim a table just by saying they have a reservation — that's how this vulnerability operates! It’s a system that gives away access like a generous host without checking their guest list. An attacker could exploit this flaw to gain unauthorized access, potentially leading to sensitive information exposure or manipulation of reservation data. This could disrupt operations, confuse customers, and create a chaotic dining experience — absolutely devastating for any restaurant trying to keep things running smoothly!

Put simply

Imagine a restaurant where anyone can stroll past the waitlist and claim a table just by saying they have a reservation — that's how this vulnerability operates! It’s a system that gives away access like a generous host without checking their guest list. This vulnerability in Rustaurius Five Star Restaurant Reservations allows attackers to bypass authorization checks due to incorrectly configured security levels, mainly affecting versions up to and including 2.7.4.

What to do

An attacker could exploit this flaw to gain unauthorized access, potentially leading to sensitive information exposure or manipulation of reservation data. This could disrupt operations, confuse customers, and create a chaotic dining experience — absolutely devastating for any restaurant trying to keep things running smoothly! To tackle this issue, patch to the latest version immediately and ensure that access controls are properly validated against user permissions. Regularly audit your configuration and test for potential access control vulnerabilities to keep your systems fortified. You’ve got this! With these steps, you’ll be well on your way to securing those reservations and keeping the dining experience a delight! 🛡️

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-01-05T16:17Z
References (1)
EPSS history
Timeline
  • 05 JAN 10:40Z
    WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability
    cvelistv5