The vulnerability in Rustaurius Five Star Restaurant Reservations allows an attacker to manipulate user-controlled identifiers to access or modify reservation information that would normally be restricted. This results in an authorization bypass that can compromise confidentiality and integrity of reservation data, leading to potential exposure of customer details and manipulation of booking operations. The weakness is classified as CWE-639, a classic example of improper authorization controls.

The issue affects the WordPress Five Star Restaurant Reservations plugin by Rustaurius, versions up to and including 2.7.4. WordPress sites running any of these plugin versions are vulnerable.

With a CVSS score of 8.6, the vulnerability is considered high severity. The EPSS score is under 1 %, indicating a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve sending crafted requests containing manipulated reservation identifiers to the plugin’s endpoints. While the description does not explicitly state prerequisites, it is inferred that an authenticated user with sufficient access to the reservation interface could exploit the flaw, and that no privilege escalation beyond that level is required.