CVE-2026-103334: Restaurant Reservations Data Leak Vulnerability

CVE-2026-103334 Overview

CVE-2026-103334 is a sensitive data exposure vulnerability in the Five Star Restaurant Reservations WordPress plugin (restaurant-reservations) developed by Etoile Web Design Incorporated. The flaw affects all versions up to and including 2.7.24. An unauthenticated attacker can retrieve embedded sensitive information that the plugin inserts into data sent over the network. The weakness is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data].

Critical Impact
Remote, unauthenticated attackers can retrieve sensitive reservation or configuration data without user interaction, impacting the confidentiality of restaurant and customer records stored in affected WordPress installations.

Affected Products

Etoile Web Design Incorporated Five Star Restaurant Reservations plugin for WordPress
All versions from n/a through 2.7.24
WordPress sites with the restaurant-reservations plugin installed and active

Discovery Timeline

2026-10-05 - CVE-2026-103334 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103334

Vulnerability Analysis

The Five Star Restaurant Reservations plugin embeds sensitive information in data transmitted to clients that should not have access to it. Because the attack vector is network-based and requires no authentication or user interaction, any remote actor who can reach the WordPress site can trigger the data exposure. The EPSS score of 0.316% reflects a low current probability of mass exploitation, but the simplicity of the attack and absence of required privileges increase operational risk for exposed sites.

The exposed data relates to the plugin's reservation workflow, which handles personal information such as names, contact details, booking times, and administrative configuration. Disclosure of this information undermines customer privacy and can facilitate follow-on attacks like phishing or targeted social engineering against restaurant staff.

Root Cause

The underlying defect is improper filtering of server responses. The plugin returns data structures that include fields intended for privileged contexts to callers who should receive a reduced view. This matches the [CWE-201] pattern, where developers include extra fields in responses without stripping them based on the requester's authorization.

Attack Vector

An attacker sends crafted or standard HTTP requests to plugin endpoints exposed by the vulnerable WordPress installation. The server returns responses containing the embedded sensitive data. No credentials, cookies, or user interaction are required. Refer to the Patchstack Vulnerability Advisory for endpoint-level details.

Detection Methods for CVE-2026-103334

Indicators of Compromise

Unusual volumes of unauthenticated requests to restaurant-reservations plugin endpoints under /wp-admin/admin-ajax.php or REST routes exposed by the plugin.
Outbound responses from WordPress containing reservation records, email addresses, or administrative fields returned to unauthenticated clients.
Scraping patterns from a single source IP enumerating booking identifiers in sequence.

Detection Strategies

Inventory WordPress installations and identify sites running restaurant-reservations at version 2.7.24 or earlier.
Review web server access logs for repeated requests to plugin AJAX actions or REST endpoints from unauthenticated sessions.
Deploy web application firewall rules that inspect responses from vulnerable endpoints for personally identifiable information fields.

Monitoring Recommendations

Enable verbose HTTP logging on WordPress hosts and forward logs to a centralized analytics platform for anomaly detection.
Alert on response payloads larger than expected baselines for reservation-related endpoints.
Track plugin version drift across managed WordPress fleets to detect sites that remain on vulnerable releases.

How to Mitigate CVE-2026-103334

Immediate Actions Required

Update the Five Star Restaurant Reservations plugin to a release later than 2.7.24 as soon as the vendor publishes a fixed version.
If no patched version is available, deactivate and remove the plugin from affected WordPress sites.
Audit historical access logs for signs of prior data retrieval and notify affected individuals where disclosure is confirmed.

Patch Information

Consult the Patchstack Vulnerability Advisory for the current patch status and upgrade guidance. Patchstack users can apply virtual patching rules through their platform while awaiting an upstream fix.

Workarounds

Restrict access to vulnerable plugin endpoints at the web application firewall or reverse proxy layer.
Enforce IP allowlisting for administrative routes exposed by the plugin.
Rotate any credentials or tokens that may have been returned in affected responses after confirming disclosure scope.

bash

# Example WAF rule concept to block anonymous access to plugin AJAX actions
# Adapt to your WAF syntax (ModSecurity shown)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1026103334,msg:'Block anonymous restaurant-reservations AJAX'"
    SecRule ARGS:action "@rx ^(nd_rst_|rtb_)" \
        "chain"
        SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"