CVE-2026-15147 describes an insufficient verification of data authenticity (CWE-345) in the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. The plugin fails to validate critical details in incoming payment notifications, such as the payment recipient, amount, and status, and does not bind these notifications to the corresponding booking. This allows unauthenticated attackers to manipulate pending reservations by marking them as paid and confirmed without proper authorization. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity but not confidentiality or availability.

An attacker can mark arbitrary pending reservations as paid and confirmed without authentication, potentially causing business logic disruption and fraudulent reservation confirmations. There is no direct impact on confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should consider additional manual verification of payment notifications or restrict access to the plugin's payment processing endpoints if possible.