CVE-2025-68044: Five Star Restaurant Reservations Bypass

CVE-2025-68044 Overview

CVE-2025-68044 is an Authorization Bypass Through User-Controlled Key vulnerability (also known as Insecure Direct Object References or IDOR) affecting the Rustaurius Five Star Restaurant Reservations WordPress plugin. This vulnerability allows attackers to exploit incorrectly configured access control security levels, potentially gaining unauthorized access to reservation data and functionality.

The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the application uses user-controllable identifiers to reference internal objects without proper authorization validation. This allows attackers to manipulate request parameters to access or modify resources belonging to other users.

Critical Impact

Attackers can bypass authorization controls to access, modify, or delete restaurant reservation data belonging to other users without authentication, potentially exposing sensitive customer information including names, contact details, and booking information.

Affected Products

• Five Star Restaurant Reservations WordPress plugin versions up to and including 2.7.8
• WordPress installations using the restaurant-reservations plugin
• All configurations where the plugin is active without additional access control measures

Discovery Timeline

• 2026-01-05 - CVE CVE-2025-68044 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-68044

Vulnerability Analysis

This IDOR vulnerability exists in the Five Star Restaurant Reservations plugin's handling of reservation objects. The plugin fails to properly validate that the requesting user has appropriate permissions to access or modify a specific reservation record. When processing reservation-related requests, the application accepts user-supplied identifiers and uses them directly to retrieve or manipulate database records without verifying ownership or authorization level.

The attack is network-accessible and requires no authentication or user interaction, making it easily exploitable. An attacker can systematically enumerate reservation IDs or manipulate request parameters to access reservation records belonging to other customers. This could expose personally identifiable information (PII) such as customer names, phone numbers, email addresses, party sizes, and special requests associated with reservations.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks when handling user-controlled keys (reservation identifiers). The plugin's code path that processes reservation retrieval and modification requests does not verify that the authenticated user (or unauthenticated visitor) has legitimate access to the requested resource. Instead, it trusts the client-supplied identifier and performs database operations directly.

This represents a classic Broken Access Control pattern where the application relies on "security through obscurity" by assuming that users won't guess or enumerate valid object identifiers, rather than implementing proper server-side authorization validation.

Attack Vector

The attack vector for CVE-2025-68044 is network-based, requiring no prior authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying the plugin's API endpoints or request handlers that accept reservation identifiers
2. Crafting requests with manipulated reservation ID parameters (sequential enumeration or targeted IDs)
3. Submitting these requests directly to the vulnerable WordPress installation
4. Receiving unauthorized access to reservation data or the ability to modify/delete reservations

The vulnerability is characterized by low attack complexity, making it accessible to attackers with minimal technical sophistication. Automated tools can easily enumerate valid reservation IDs and extract associated data at scale.

Detection Methods for CVE-2025-68044

Indicators of Compromise

• Unusual patterns of sequential or bulk reservation ID access attempts in web server logs
• Access log entries showing successful retrieval of multiple reservation records from a single IP address or session
• Anomalous request patterns to plugin endpoints containing incrementing or random ID parameters
• Error logs indicating failed authorization or access control exceptions (though the vulnerability may not log failures)

Detection Strategies

• Monitor web application firewall (WAF) logs for parameter tampering attempts targeting reservation-related endpoints
• Implement rate limiting detection for repeated requests to reservation API endpoints with varying ID parameters
• Analyze access patterns for unusual cross-user data access that may indicate IDOR exploitation
• Deploy WordPress security plugins that monitor for suspicious plugin activity and unauthorized data access

Monitoring Recommendations

• Enable detailed access logging for the WordPress installation and the restaurant-reservations plugin directory
• Configure alerting for bulk data retrieval patterns or enumeration attempts against reservation endpoints
• Implement user behavior analytics to detect anomalous access patterns indicative of IDOR exploitation
• Regularly audit plugin access logs for signs of unauthorized reservation data access

How to Mitigate CVE-2025-68044

Immediate Actions Required

• Update the Five Star Restaurant Reservations plugin to a version newer than 2.7.8 that addresses the vulnerability
• Review access logs for any signs of exploitation and assess potential data exposure
• Temporarily disable the plugin if an immediate patch is not available and the risk is unacceptable
• Notify affected customers if unauthorized access to their reservation data is suspected
• Implement additional access controls at the web application firewall level to restrict unauthorized API access

Patch Information

The vulnerability affects Five Star Restaurant Reservations versions through 2.7.8. Organizations should consult the Patchstack WordPress Vulnerability Report for the latest patch information and update to the most recent version available that addresses this vulnerability.

Workarounds

• Implement web application firewall (WAF) rules to validate and restrict access to reservation endpoints based on session authentication
• Add custom WordPress filters or hooks to enforce additional authorization checks on reservation data access
• Restrict network access to the WordPress admin and API endpoints using IP allowlisting where feasible
• Consider implementing an additional authentication layer for sensitive reservation management functions

# Example .htaccess rules to restrict plugin access (customize paths as needed)
# Add to WordPress root .htaccess or plugin directory
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block direct access to plugin AJAX handlers from unauthenticated users
    RewriteCond %{REQUEST_URI} ^.*restaurant-reservations.*$ [NC]
    RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
    RewriteRule ^(.*)$ - [F,L]
</IfModule>