CVE-2025-68044: 
WordPress vulnerability analysis and mitigation

CVE-2025-68044 is an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in the Five Star Restaurant Reservations WordPress plugin by Rustaurius. It affects all versions through 2.7.4 and allows unauthenticated remote attackers to bypass authorization controls by exploiting incorrectly configured access control security levels. The vulnerability was reported on October 12, 2025, and published by Patchstack on January 2–5, 2026. It carries a CVSS v3.1 base score of 8.6 (High), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). The root cause lies in the plugin's failure to properly validate server-side authorization when processing user-supplied keys or identifiers that reference reservation objects, allowing attackers to manipulate these keys to access or interact with reservation records they should not be permitted to view. No authentication, elevated privileges, or user interaction is required for exploitation, and the attack is conducted entirely over the network (Patchstack, Red Hat CVE).

Successful exploitation allows an unauthenticated attacker to bypass authorization controls and gain unauthorized access to restaurant reservation data, resulting in high confidentiality impact (disclosure of sensitive reservation information such as customer names, contact details, and booking records) along with low integrity and availability impacts (potential modification or disruption of reservation data). The vulnerability affects any WordPress site running the Five Star Restaurant Reservations plugin at version 2.7.4 or earlier, and Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of websites simultaneously (Patchstack).

There is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and warns that IDOR vulnerabilities of this nature are frequently leveraged in mass-exploit campaigns against WordPress sites (Patchstack, Red Hat CVE).

The vulnerability is patched in Five Star Restaurant Reservations version 2.7.5. Site administrators should update the plugin to version 2.7.5 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance, and consider using Patchstack's virtual patching/mitigation rule, which blocks exploitation attempts until the plugin is updated. Additionally, server-side access control reviews should be conducted to ensure authorization is enforced independently of user-supplied input (Patchstack).

The vulnerability received brief coverage from automated security news aggregators and social media accounts including TheHackerWire on Mastodon and Bluesky, as well as mentions on CVE tracking platforms. No notable independent researcher commentary or significant media coverage beyond standard vulnerability disclosure channels has been identified.