Payment Bypass in Five Star Restaurant Reservations Plugin for WordPress

CVE-2026-6498

What is CVE-2026-6498?

The Five Star Restaurant Reservations plugin for WordPress is susceptible to a payment bypass vulnerability due to PHP type juggling. This issue arises in versions up to 2.7.16, where the valid_payment() function erroneously employs a loose comparison using the payment_id POST parameter against the booking's stripe_payment_intent_id property. An attacker can exploit this by triggering a request to the nopriv AJAX handler rtb_stripe_pmt_succeed prior to the creation of a Stripe payment intent. Consequently, if the payment_id is submitted as an empty string, the loose comparison evaluates to TRUE, allowing unauthorized users to falsely mark bookings as paid without completing the actual transaction.

References