CVE-2026-42670: Five Star Restaurant Reservations Bypass

CVE-2026-42670 Overview

CVE-2026-42670 is a missing authorization vulnerability in the Etoile Web Design Five Star Restaurant Reservations plugin for WordPress. The flaw affects all versions from initial release through 2.7.14. Attackers can exploit incorrectly configured access control security levels to bypass payment requirements during the reservation workflow. The vulnerability is network-accessible, requires no authentication, and demands no user interaction. The weakness maps to [CWE-862] Missing Authorization. Patchstack tracks this issue as a payment bypass affecting the restaurant-reservations plugin.

Critical Impact
Unauthenticated attackers can bypass payment controls in restaurant reservation workflows, allowing them to complete bookings without satisfying the configured payment requirements.

Affected Products

Etoile Web Design Five Star Restaurant Reservations plugin for WordPress
All versions up to and including 2.7.14
WordPress sites using the restaurant-reservations plugin for booking management

Discovery Timeline

2026-06-02 - CVE CVE-2026-42670 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-42670

Vulnerability Analysis

The Five Star Restaurant Reservations plugin exposes reservation and payment-handling endpoints without enforcing proper authorization checks. The plugin's access control configuration fails to verify that a request fulfills the payment requirement before finalizing a booking. An unauthenticated remote attacker can craft requests directly to the vulnerable endpoint and complete the reservation flow while skipping the payment step. The impact is scoped to confidentiality of restricted booking functionality and revenue loss for site operators relying on the plugin's payment gating.

Root Cause

The root cause is a missing authorization check on a sensitive plugin action. The code path that finalizes a reservation does not validate that the caller has satisfied the configured payment workflow. Access control security levels are incorrectly configured, allowing the payment-protected action to be invoked without the required state. This is a classic [CWE-862] Missing Authorization weakness in business logic enforcement.

Attack Vector

An attacker sends crafted HTTP requests to the WordPress site running the vulnerable plugin. The request targets the reservation endpoint exposed by the plugin and skips parameters or steps that would normally trigger the payment requirement. Because the plugin does not re-verify authorization server-side, the booking is accepted. No credentials, prior session, or social engineering are required. The exploitation is fully remote over the network.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-42670

Indicators of Compromise

Reservation records in the plugin database created without associated payment transaction identifiers
Successful HTTP 200 responses to plugin reservation endpoints from clients that never invoked the payment gateway flow
Anomalous volume of bookings originating from a single IP or user-agent without payment correlation
Discrepancies between reservation count and payment processor transaction count over the same window

Detection Strategies

Review WordPress access logs for direct POST requests to restaurant-reservations plugin endpoints that bypass the expected multi-step payment flow
Reconcile reservation entries with payment processor records to surface bookings completed without a matching charge
Monitor for repeated requests to the reservation submission endpoint that omit payment-related parameters

Monitoring Recommendations

Enable WordPress audit logging for all plugin-handled AJAX and REST actions in the restaurant-reservations namespace
Forward web server and plugin logs to a centralized SIEM for correlation against payment gateway events
Alert on any reservation creation event lacking a corresponding payment confirmation within a defined time window

How to Mitigate CVE-2026-42670

Immediate Actions Required

Identify all WordPress instances running the Five Star Restaurant Reservations plugin at version 2.7.14 or earlier
Upgrade the plugin to a version that addresses the payment bypass once released by the vendor
Audit existing reservations created on or before the patch date for entries without matching payment records
Restrict access to the WordPress site behind a web application firewall while patching is in progress

Patch Information

The vulnerability affects Five Star Restaurant Reservations versions through 2.7.14. Site administrators should consult the Patchstack Vulnerability Report for the fixed version and apply the update through the WordPress plugin manager.

Workarounds

Temporarily disable the Five Star Restaurant Reservations plugin if a patched version is not yet available
Configure web application firewall rules to block direct requests to reservation submission endpoints that lack expected payment parameters
Manually reconcile each new reservation against payment processor records until the plugin is updated

bash

# Example: list and disable the vulnerable plugin via WP-CLI
wp plugin list --name=restaurant-reservations --fields=name,status,version
wp plugin deactivate restaurant-reservations