WordPress Five Star Restaurant Reservations Plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) Schwachstelle

The CSRF vulnerability in Five Star Restaurant Reservations allows an attacker to execute actions as a logged-in user. This could include creating, modifying, or deleting reservations, changing user roles, or accessing sensitive data. Successful exploitation requires the victim to be logged into the WordPress site and visit a malicious webpage crafted by the attacker. The impact is amplified if the attacker can target users with administrative privileges, potentially granting them full control over the reservation system. While no specific real-world exploitation has been publicly reported, CSRF vulnerabilities are commonly exploited in WordPress plugins.

Websites utilizing the Five Star Restaurant Reservations plugin, particularly those with user accounts and reservation functionality, are at risk. Shared hosting environments where multiple WordPress installations share the same server resources are also at increased risk, as a compromise of one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'restaurant-reservations/includes/class-reservation.php' . |
 grep -i 'add_reservation' # Look for vulnerable code patterns

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=restaurant_reservations_add_reservation&reservation_date=2024-12-31&reservation_time=19%3A00&number_of_guests=2 # Check for lack of CSRF token in request

1. 2025-12-24Disclosure

   disclosure

1. Reserviert2025-12-19
2. Veröffentlicht2025-12-24
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-68601 is to upgrade the Five Star Restaurant Reservations plugin to version 2.7.9 or later. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. Additionally, ensure that all user input is properly validated and sanitized to prevent malicious code injection. Implement a Content Security Policy (CSP) to restrict the sources from which the browser can load resources, further reducing the attack surface. After upgrading, verify the fix by attempting to submit a reservation request from a different browser or incognito window to ensure CSRF protection is active.

Aktive Installationen

10KBekannt

Plugin-Bewertung