CVE-2026-6498 is a vulnerability in the Five Star Restaurant Reservations WordPress plugin caused by insufficient verification of data authenticity (CWE-345). The valid_payment() function uses a PHP loose equality check (==) between the payment_id POST parameter and the booking object's stripe_payment_intent_id. If the stripe_payment_intent_id is null (before Stripe payment intent creation), submitting an empty payment_id results in the comparison evaluating to true, enabling an unauthenticated attacker to bypass payment and mark bookings as paid without completing a Stripe payment. This affects versions up to and including 2.7.16.

The vulnerability allows unauthenticated attackers to bypass payment verification and mark any existing payment_pending booking as paid without making an actual Stripe payment. This can lead to unauthorized free bookings and potential financial loss for the merchant. There is no confidentiality or availability impact indicated.

Patch status is not yet confirmed — no official fix or patch is currently available. Users should monitor the vendor's advisory for updates. Until a patch is released, consider implementing additional server-side validation to ensure payment intent IDs are properly verified and avoid relying on PHP loose comparisons for critical payment verification logic.