CVE-2025-68601: CSRF in Five Star Restaurant Reservations

The CSRF vulnerability in Five Star Restaurant Reservations allows an attacker to execute actions as a logged-in user. This could include creating, modifying, or deleting reservations, changing user roles, or accessing sensitive data. Successful exploitation requires the victim to be logged into the WordPress site and visit a malicious webpage crafted by the attacker. The impact is amplified if the attacker can target users with administrative privileges, potentially granting them full control over the reservation system. While no specific real-world exploitation has been publicly reported, CSRF vulnerabilities are commonly exploited in WordPress plugins.

1. Reserved2025-12-19
2. Published2025-12-24
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-68601 is to upgrade the Five Star Restaurant Reservations plugin to version 2.7.9 or later. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. Additionally, ensure that all user input is properly validated and sanitized to prevent malicious code injection. Implement a Content Security Policy (CSP) to restrict the sources from which the browser can load resources, further reducing the attack surface. After upgrading, verify the fix by attempting to submit a reservation request from a different browser or incognito window to ensure CSRF protection is active.

Active installs

10KKnown

Plugin rating