CVE-2025-68044
Published: 05 January 2026
Summary
CVE-2025-68044 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-68044 is an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) in the Five Star Restaurant Reservations WordPress plugin, also known as restaurant-reservations by Rustaurius. It stems from exploiting incorrectly configured access control security levels and affects all versions from n/a through 2.7.4. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, and lack of prerequisites.
Unauthenticated attackers can exploit this vulnerability remotely without user interaction. Successful exploitation allows bypassing authorization controls via a user-controlled key, potentially leading to high confidentiality impact such as unauthorized access to sensitive reservation data, low integrity impact like limited modifications, and low availability impact.
The Patchstack advisory references this as an insecure direct object reference (IDOR) vulnerability patched in version 2.7.7 of the Five Star Restaurant Reservations plugin. Security practitioners should update affected WordPress sites to 2.7.7 or later to mitigate the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0876
Vulnerability details
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct IDOR/authz bypass in public-facing WordPress plugin enables remote unauthenticated exploitation of a web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to reservation data, directly preventing unauthorized bypass via user-controlled keys in the plugin.
Validates user-controlled keys and inputs to block exploitation of incorrectly configured access control security levels.
Mandates timely patching of flaws like this IDOR vulnerability, as fixed in plugin version 2.7.7.