CVE-2026-15147CWE-345CWE-639
CVE-2026-15147
Medium · published August 7, 2026
What it is
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00163 · 5.2th percentile
- Weaknesses
- CWE-345 · Insufficient Verification of Data Authenticity; CWE-639 · Authorization Bypass Through User-Controlled Key
- Published
- 2026-08-07T02:16Z
References (1)
EPSS history
Timeline