Threats tagged 'ghsa-75mc-5wvp-r4qm'

The Five Star Restaurant Reservations plugin for WordPress versions up to 2.7.16 contains a vulnerability that allows unauthenticated attackers to bypass payment verification. This occurs due to a PHP type juggling issue in the valid_payment() function, where a loose comparison between an empty payment_id and a null payment intent ID incorrectly validates the payment. Attackers can mark bookings as paid without completing a Stripe payment by submitting an empty payment_id parameter.