Five Star Restaurant Reservations <= 2.7.24 - Unauthenticated Sensitive Information Exposure via View Bookings Form
- ID
- WPSEC-2026-0121
- Plugin
- Five Star Restaurant Reservations – WordPress Booking Plugin (restaurant-reservations)
- Affected
- from 2.0.0 before 2.8.0
- Remediation
- Update to 2.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Five Star Restaurant Reservations on WPSec AttackSurface
- Fix released
- Published
Description
The Five Star Restaurant Reservations plugin for WordPress is vulnerable to Sensitive Information Exposure via the front-end view bookings form ([view-bookings-form] shortcode, the bundled View Bookings pattern and page-builder element, and the configured view-bookings page) in versions 2.0.0 up to, and including, 2.7.24. This is due to a missing authorization check in rtb_print_view_bookings_form(): the only gate, the optional 'view-bookings-private' setting, merely required a logged-in user and was applied only when the form was appended to the configured page, never when it was rendered through the shortcode. This makes it possible for unauthenticated attackers to list reservations, including guest names, email addresses, phone numbers, party sizes, tables, statuses and messages, for any date chosen through the 'date' parameter on any page where the form is displayed, even where the page was meant to be private. Authenticated attackers with contributor-level access can also render the form themselves in a post preview.
References
- https://wpsec.com/vuln/WPSEC-2026-0121/
- https://plugins.svn.wordpress.org/restaurant-reservations/tags/2.8.0/
- https://wordpress.org/plugins/restaurant-reservations/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS