CVE-2026-6498: 
WordPress vulnerability analysis and mitigation

CVE-2026-6498 is a payment bypass vulnerability via PHP type juggling in the Five Star Restaurant Reservations plugin for WordPress, affecting versions up to and including 2.7.16. The flaw allows unauthenticated attackers to mark any payment_pending booking as paid without completing an actual Stripe payment. It was published on April 30, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity) and stems from the valid_payment() function in PaymentGatewayStripe.class.php using a PHP loose comparison operator (==) to validate payment intent IDs. When an unauthenticated attacker sends a POST request to the nopriv AJAX handler rtb_stripe_pmt_succeed with an empty payment_id parameter before the Stripe payment intent has been created for a booking, the booking's stripe_payment_intent_id property remains null. PHP's loose comparison evaluates sanitize_text_field('') == null as TRUE, causing the payment verification check to pass without any actual payment being processed (GitHub Advisory, Wordfence). The vulnerable code is visible in the plugin's Trac repository at line 458 of PaymentGatewayStripe.class.php in versions up to 2.7.13 and 2.7.16 (WordPress Trac).

Successful exploitation allows unauthenticated attackers to fraudulently confirm restaurant reservations without completing any Stripe payment, directly compromising the integrity of payment transactions. Businesses relying on the plugin may suffer financial losses as bookings are confirmed without corresponding revenue. There is no confidentiality or availability impact; the scope is limited to integrity of payment records within the affected WordPress installation (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable if a target booking is in payment_pending state before the Stripe intent is created. The EPSS score is approximately 0.026% (0.000260), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify WordPress sites running the Five Star Restaurant Reservations plugin (versions ≤ 2.7.16) by inspecting page source for plugin-specific assets or using tools like WPScan.
2. Identify a target booking: Locate or create a reservation that is in payment_pending status. The booking must not yet have a Stripe payment intent ID stored in its post meta (i.e., the client-side create_stripe_pmtIntnt() JavaScript call has not yet executed).
3. Craft the malicious request: Send an HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the rtb_stripe_pmt_succeed action with the target booking ID and an empty payment_id parameter:

   POST /wp-admin/admin-ajax.php
   action=rtb_stripe_pmt_succeed&booking_id=<TARGET_ID>&payment_id=

4. Trigger the type juggling bypass: The valid_payment() function compares sanitize_text_field('') == null, which evaluates to TRUE in PHP loose comparison, causing the payment check to pass.
5. Booking confirmed: The booking status is updated to paid/confirmed without any actual Stripe payment being processed (GitHub Advisory, Wordfence).

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=rtb_stripe_pmt_succeed and an empty or missing payment_id parameter from unexpected or unauthenticated sources.
• Logs: WordPress access logs showing repeated or anomalous calls to the rtb_stripe_pmt_succeed AJAX action without corresponding Stripe webhook events or payment confirmations in Stripe's dashboard.
• Application Data: Bookings in the restaurant reservations system that transitioned from payment_pending to a paid/confirmed state without a corresponding Stripe payment intent ID recorded in post meta or a matching Stripe transaction in the payment dashboard.

Users should immediately update the Five Star Restaurant Reservations plugin to version 2.7.17 or later, which addresses the type juggling issue by replacing the loose comparison with a strict comparison (===) in the valid_payment() function (WordPress Trac Changeset). As a post-incident measure, administrators should review booking records for any suspicious payment_pending to paid status transitions that may have occurred while running vulnerable versions. No configuration-based workaround is available; patching is the only remediation (Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the period of April 27–May 3, 2026 (Wordfence Blog). The vulnerability received standard automated coverage across CVE aggregation platforms and social media bots (e.g., CVEnew on Nitter, Bluesky) shortly after disclosure, with no notable independent researcher commentary or significant community discussion observed.