The Five Star Restaurant Reservations WordPress plugin before version 2.7.9 lacks cross‑site request forgery protection for certain bulk booking actions, which can allow an attacker to manipulate a logged‑in administrator into deleting reservations. This weakness is an example of CWE‑352, where an unauthorized user forces a legitimate user to perform an unintended action without confirmation of intent.

The vulnerability affects the Five Star Restaurant Reservations plugin for WordPress in all versions earlier than 2.7.9. Administrators using these versions are at risk of having their booking data erased via crafted requests sent from a malicious site.

The vulnerability has a moderate CVSS score of 4.3 and a very low exploitation probability (EPSS < 1 %). It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to coerce a legitimate administrator to process a malicious request, typically by embedding a CSRF link in a fraud or phishing page. Because the exploit requires a logged‑in admin session, its likelihood is limited to scenarios where administrators are unaware of the attacker’s presence, making this a moderate but opportunistic risk.