CVE-2025-68601: 
WordPress vulnerability analysis and mitigation

CVE-2025-68601 is a Cross-Site Request Forgery (CSRF) vulnerability in the Rustaurius Five Star Restaurant Reservations WordPress plugin (restaurant-reservations). It affects all versions from n/a through 2.7.7 (some sources cite through 2.7.8). The vulnerability was published on December 24, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate or enforce anti-CSRF tokens on sensitive state-changing requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by a logged-in WordPress user with appropriate privileges, causes the victim's browser to submit forged requests to the plugin's endpoints without the user's knowledge. Exploitation requires user interaction — specifically, a logged-in user must be tricked into clicking a malicious link or visiting an attacker-controlled page (Feedly).

Successful exploitation allows an attacker to perform unauthorized actions on the restaurant reservations system on behalf of a logged-in user, including unauthorized modification or deletion of reservations, manipulation of booking settings, and potential disruption of the reservation management functionality. The vulnerability has low integrity and low availability impact with no confidentiality impact, limiting the blast radius to the plugin's functional scope rather than full site compromise (Feedly).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick a logged-in user into interacting with a malicious link or page.

1. Reconnaissance: Identify WordPress sites running the Five Star Restaurant Reservations plugin version 2.7.7 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Craft malicious request: Construct an HTML page or form that automatically submits a forged HTTP request to the target site's plugin endpoint (e.g., a reservation modification or settings update action) without a valid CSRF token.
3. Deliver payload: Trick a logged-in WordPress administrator or user with reservation management privileges into visiting the attacker-controlled page, via phishing email, malicious link, or embedded iframe.
4. Achieve objective: The victim's browser automatically submits the forged request with their authenticated session cookies, causing the plugin to process the unauthorized action — such as modifying reservation data or altering booking settings — without the user's consent (Feedly).

• Logs: Unexpected POST requests to Five Star Restaurant Reservations plugin endpoints (e.g., wp-admin/admin-ajax.php or plugin-specific action URLs) originating from unusual referrers or external domains in WordPress access logs.
• Application: Unexplained changes to reservation records, booking settings, or plugin configuration not attributable to known administrator actions.
• Network: Requests to reservation management endpoints with Referer headers pointing to external or unknown domains rather than the site itself.

Users should update the Five Star Restaurant Reservations plugin to a version beyond 2.7.7 (or 2.7.8, per some sources) as soon as a patched release is available from the plugin vendor. As interim mitigations, administrators can implement additional CSRF protection via a WordPress security plugin (e.g., Wordfence, Sucuri), enforce strict session management, and educate users about the risks of clicking unknown links while logged into WordPress. Restricting access to the WordPress admin area by IP address can also reduce exposure (Feedly).

The vulnerability was noted by TheHackerWire on social platforms including Mastodon and Bluesky shortly after disclosure on December 24, 2025. Coverage has been limited to automated vulnerability aggregators and security news feeds, with no significant independent researcher commentary or vendor statements beyond the Patchstack advisory (Feedly).