CVE-2026-25327: 
WordPress vulnerability analysis and mitigation

CVE-2026-25327 is a Missing Authorization (Broken Access Control) vulnerability in the Five Star Restaurant Reservations WordPress plugin by Rustaurius. It affects all versions up to and including 2.7.9, allowing unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability was reported on January 5, 2026, and publicly disclosed on March 23–25, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated remote attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting the absence of proper nonce token or capability checks. No authentication or user interaction is required, and the attack complexity is low. The vulnerability was discovered by security researcher johska and assigned by Patchstack (Patchstack).

Successful exploitation results in limited but tangible impacts: attackers can access restricted information (low confidentiality impact) and potentially disrupt plugin functionality (low availability impact), though integrity is not directly affected. Because no authentication is required, the vulnerability is accessible to any remote attacker targeting WordPress sites running the affected plugin. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact, though the unauthenticated attack vector means it could be incorporated into automated WordPress scanning tools (Patchstack).

The vendor has released version 2.7.10 of the Five Star Restaurant Reservations plugin, which patches this vulnerability. Site administrators should update the plugin to version 2.7.10 or later immediately via the WordPress admin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering March 23–29, 2026, reflecting standard industry tracking of WordPress plugin security issues. No notable researcher commentary or significant social media discussion has been identified beyond routine vulnerability database entries (Wordfence Blog).