Threats tagged 'ghsa-4prh-qcrv-cpfg'

The Five Star Restaurant Reservations WordPress plugin before version 2.7.23 has a vulnerability where it does not verify the authenticity of incoming payment notifications. This flaw allows unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed without validating the payment recipient, amount, status, or binding the notification to the intended booking.