Insufficient verification of data authenticity in Rustaurius Five Star Restaurant…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.
Summary
The Five Star Restaurant Reservations plugin for WordPress is vulnerable to a payment bypass via PHP type juggling in versions up to, and including, 2.7.16 This is due to the valid_payment() function using a PHP loose comparison (==) between the attacker-controlled payment_id POST parameter and the booking's stripe_payment_intent_id property. When an unauthenticated attacker submits a request to the nopriv AJAX handler rtb_stripe_pmt_succeed before the Stripe payment intent has been created for a booking (i.e., before the JavaScript-triggered create_stripe_pmtIntnt() call has stored an intent ID in post meta), the stripe_payment_intent_id property on the booking object remains null. The comparison sanitize_text_field('') == null evaluates to TRUE in PHP loose comparison, causing the payment verification check to pass with zero actual payment. This makes it possible for unauthenticated attackers to mark any existing payment_pending booking as paid without completing a Stripe payment by submitting an empty payment_id parameter.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rustaurius | Five Star Restaurant Reservations – WordPress Booking Plugin | up to 2.7.16 | — | No fix listed | CNA |
- Five Star Restaurant Reservations – WordPress Booking Plugin VendorRustaurius Affected up to 2.7.16 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6498
- 2026-10-03 Alias added: GHSA-75mc-5wvp-r4qm
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ee08aac-7bcc-4809-a5aa-7b95ed736f19?source=cve
- https://plugins.trac.wordpress.org/browser/restaurant-reservations/trunk/includes/PaymentGatewayStripe.class.php#L458
- https://plugins.trac.wordpress.org/browser/restaurant-reservations/tags/2.7.13/includes/PaymentGatewayStripe.class.php#L458
- https://plugins.trac.wordpress.org/browser/restaurant-reservations/trunk/includes/PaymentGatewayStripe.class.php#L404
- https://plugins.trac.wordpress.org/browser/restaurant-reservations/tags/2.7.13/includes/PaymentGatewayStripe.class.php#L404
- https://plugins.trac.wordpress.org/changeset/3518833/restaurant-reservations/trunk/includes/PaymentGatewayStripe.class.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Frestaurant-reservations/tags/2.7.16&new_path=%2Frestaurant-reservations/tags/2.7.17
More Rustaurius vulnerabilities
- TI-2025-01743 Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2020-18897 Ultimate Reviews < 2.1.33 - PHP Object Injection CVSS 3.1CRITICAL 9.8
- TI-2025-41653 WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability CVSS 3.1HIGH 8.6
- TI-2026-21847 WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability CVSS 3.1CRITICAL 9.1
- TI-2025-30077 WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
- TI-2025-06360 Missing authorization in Rustaurius Ultimate WP Mail CVSS 3.1HIGH 8.8
Sources
- CVE-2026-6498 · CVE Program
- CVE-2026-6498 · NVD
- FIRST EPSS
- GHSA-75mc-5wvp-r4qm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences