# CVE-2026-54830: Etoile Web Design Five Star Restaurant Reservations broken access control

Source: https://junglewise.ai/threats/cve-2026-54830-etoile-web-design-five-star-restaurant-reservations-broken-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-54830 · Severity: high · CVSS 7.5 · Published 2026-06-25

The Five Star Restaurant Reservations plugin for WordPress, which manages table bookings and customer reservations, contains a security flaw that allows unauthorized individuals to perform actions they should not have access to. An attacker could potentially modify reservation data or system settings without needing to log in. This could lead to disrupted restaurant operations, loss of customer booking data, or unauthorized changes to the restaurant's reservation system.

Technologies: [Etoile Web Design Five Star Restaurant Reservations](https://junglewise.ai/threats/technologies/five-star-restaurant-reservations). Vendors: [Etoile Web Design](https://junglewise.ai/threats/vendors/etoile-web-design).

## Quick answers

**Is CVE-2026-54830 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54830 being exploited in the wild.

**How severe is CVE-2026-54830?** High severity, with a CVSS score of 7.5, published 25 June 2026.

**Which products and versions are affected?** Etoile Web Design Five Star Restaurant Reservations <= 2.7.19.

**Is there a fix for CVE-2026-54830?** A patch was published on 2026-06-25: Patch confirmed available in version 2.7.20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54830 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54830?** Check whether you run Etoile Web Design Five Star Restaurant Reservations at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Five Star Restaurant Reservations plugin for WordPress (versions <= 2.7.19) suffers from a broken access control vulnerability due to missing authorization checks (CWE-862). This flaw allows an unauthenticated remote attacker to execute functions or modify data that should be restricted to administrative users. The vulnerability is exploited via network requests without requiring any user interaction or prior authentication. The issue is resolved in version 2.7.20, which introduces the necessary authorization and nonce validation to secure the affected components.

## Affected products

- Etoile Web Design Incorporated Five Star Restaurant Reservations <= 2.7.19

## Timeline

- 2026-05-18: other: Reported by Vincent Sevkli
- 2026-06-17: advisory: Patchstack advisory published
- 2026-06-25: disclosed: NVD publication date
- 2026-06-25: patched: Patch confirmed available in version 2.7.20

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/restaurant-reservations/vulnerability/wordpress-five-star-restaurant-reservations-plugin-2-7-19-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/restaurant-reservations/vulnerability/wordpress-five-star-restaurant-reservations-plugin-2-7-19-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Etoile Web Design Five Star Restaurant Reservations payment bypass](https://junglewise.ai/threats/cve-2026-42670-etoile-web-design-five-star-restaurant-reservations-payment)