CVE-2026-0658: medium-severity vulnerability in Five Star Restaurant Reservations
Five Star Restaurant Reservations < 2.7.9 - Arbitrary Bookings Deletion via CSRF
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.2%
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting bookings via CSRF attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
Unknown · Five Star Restaurant ReservationsRelated CVEs — Five Star Restaurant Reservations
In the same product, most dangerous first.
CVE-2022-0421MEDIUMFive Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSSEPSS 0.6%CVE-2026-15151HIGHFive Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notificationsEPSS 0.4%CVE-2026-15147MEDIUMFive Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOREPSS 0.2%