CVE-2025-30861 Overview
CVE-2025-30861 is a missing authorization vulnerability in the Rustaurius Five Star Restaurant Reservations plugin for WordPress (restaurant-reservations). The flaw affects all versions up to and including 2.6.29. The issue stems from incorrectly configured access control security levels, allowing authenticated users to perform actions outside their intended privilege scope. The weakness is classified as [CWE-862] Missing Authorization. Exploitation requires network access and high privileges, but no user interaction, and can impact the availability of the affected WordPress site.
Critical Impact
Authenticated attackers with elevated privileges can abuse broken access control in the Five Star Restaurant Reservations plugin to disrupt reservation availability on affected WordPress sites.
Affected Products
- Rustaurius Five Star Restaurant Reservations (restaurant-reservations) plugin for WordPress
- All plugin versions from initial release through 2.6.29
- WordPress sites running the vulnerable plugin configuration
Discovery Timeline
- 2025-03-27 - CVE CVE-2025-30861 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30861
Vulnerability Analysis
The Five Star Restaurant Reservations plugin exposes functionality that fails to validate the capability of the requesting user. The plugin relies on access control logic that does not enforce the correct privilege level before executing sensitive operations. An authenticated user with higher-than-expected access can therefore trigger actions reserved for administrators. The vulnerability affects availability of the plugin's reservation data and workflows, but does not directly impact confidentiality or integrity of the WordPress installation.
Root Cause
The root cause is a missing authorization check [CWE-862] on one or more plugin endpoints. The plugin does not verify the user's WordPress capability (for example, through current_user_can()) before processing privileged requests. Access control relies on authentication alone rather than role-based authorization, which is insufficient for administrative operations.
Attack Vector
An attacker must be authenticated to the target WordPress instance with high privileges to reach the vulnerable code path. Once authenticated, the attacker sends crafted HTTP requests to plugin endpoints that lack capability checks. Successful exploitation can disrupt reservation functionality, delete or alter reservation state, and cause denial of service for the reservation workflow. See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-30861
Indicators of Compromise
- Unexpected modifications, deletions, or state changes to reservation records in the WordPress database tables used by restaurant-reservations.
- WordPress audit log entries showing privileged plugin actions originating from accounts that should not possess administrative capability.
- HTTP POST requests to admin-ajax.php or plugin REST endpoints referencing restaurant reservation actions from unexpected user sessions.
Detection Strategies
- Review WordPress access logs for anomalous requests to restaurant-reservations plugin endpoints, especially from non-administrator accounts.
- Correlate plugin-related administrative actions with the role assigned to the requesting user and flag mismatches.
- Deploy a web application firewall rule to log and alert on requests targeting known vulnerable plugin actions.
Monitoring Recommendations
- Enable WordPress activity logging to capture user, role, and action metadata for every plugin interaction.
- Monitor plugin version inventory across managed WordPress sites and alert on installations at or below version 2.6.29.
- Track outbound responses from the plugin for unexpected success codes tied to privileged operations.
How to Mitigate CVE-2025-30861
Immediate Actions Required
- Update the Five Star Restaurant Reservations plugin to a version later than 2.6.29 as soon as the vendor releases a fixed build.
- Audit WordPress user accounts and remove unnecessary elevated privileges to reduce the exploitable population.
- Restrict administrative access to the WordPress backend using IP allowlists and multi-factor authentication.
Patch Information
Consult the Patchstack Vulnerability Report for current patch availability and version guidance. Apply the vendor-supplied update that adds proper capability checks to the affected plugin endpoints.
Workarounds
- Temporarily deactivate the restaurant-reservations plugin if a patched version is not yet available and the business can tolerate downtime of the reservation feature.
- Apply web application firewall rules that block unauthenticated or low-privilege requests to the plugin's AJAX and REST endpoints.
- Enforce least-privilege role assignments so that only trusted administrators retain capabilities that could reach the vulnerable code path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.