Unauthenticated Broken Access Control in the Five Star Restaurant Reservations plugin allows an attacker to perform privileged actions without proper authorization. The weakness, identified as CWE-862, could enable unauthorized users to view, modify, or delete reservation data, potentially compromising confidentiality, integrity, and availability of the reservation system.

Any WordPress site that has the Five Star Restaurant Reservations plugin version 2.7.19 or earlier installed. The plugin is produced by Etoile Web Design Incorporated and is intended for restaurant reservation management.

The CVSS score of 7.5 indicates a medium-to-high severity. While no EPSS score is available, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed exploits yet. The attack vector is likely through unauthenticated web requests to the plugin’s endpoints. The potential impact is significant, especially on sites that rely on the plugin for reservation operations, and the risk warrants prompt remediation.