A Cross‑Site Request Forgery flaw exists in the Rustaurius Five Star Restaurant Reservations plugin, allowing an attacker to cause a logged‑in user to perform unintended actions within the reservation system. The vulnerability is a classic example of CWE‑352, where an authenticated session can be coerced into sending requests that the user did not intend.

The flaw impacts all installations of the Five Star Restaurant Reservations plugin version 2.7.8 or earlier. No other versions are listed as affected. Site owners using these versions are at risk until they apply a fix.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% shows that exploitation is currently considered unlikely to occur. The vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is via a crafted link or form that a logged‑in user clicks, causing the reservation plugin to process the request with the user’s credentials. The exploit would require the victim to be authenticated to the target site.