CVE-2026-54835: Five Star Restaurant Menu and Food Ordering <= 2.5.2 Missing Authorization PoC, Patch Analysis & Rule

--- a/food-and-drink-menu/food-and-drink-menu.php
+++ b/food-and-drink-menu/food-and-drink-menu.php
@@ -3,8 +3,9 @@
  * Plugin Name: Five Star Restaurant Menu and Food Ordering
  * Plugin URI: https://www.fivestarplugins.com/plugins/five-star-restaurant-menu/
  * Description: Restaurant menu and food ordering system that is easy to set up and integrates with any theme. Includes restaurant menu blocks and patterns.
- * Version: 2.5.2
+ * Version: 2.5.3
  * Requires at least: 6.0
+ * Requires PHP: 8.0
  * Author: Five Star Plugins
  * Author URI: https://www.fivestarplugins.com/
  * Text Domain: food-and-drink-menu
@@ -43,7 +44,7 @@
 		define( 'FDM_PLUGIN_FNAME', plugin_basename( __FILE__ ) );
 		define( 'FDM_UPGRADE_URL', 'https://www.fivestarplugins.com/license-payment/?Selected=FDM&Quantity=1' );
 		define( 'FDM_TEMPLATE_DIR', 'fdm-templates' );
-		define( 'FDM_VERSION', '2.5.2' );
+		define( 'FDM_VERSION', '2.5.3' );
 		define( 'FDM_MENU_POST_TYPE', 'fdm-menu' );
 		define( 'FDM_MENUITEM_POST_TYPE', 'fdm-menu-item' );
 		define( 'FDM_ORDER_POST_TYPE', 'fdm-order' );
--- a/food-and-drink-menu/includes/class-order-item.php
+++ b/food-and-drink-menu/includes/class-order-item.php
@@ -81,6 +81,12 @@
 	// The custom fields associated with this order
 	public $custom_fields = array();

+	// Stripe payment properties
+	public $stripe_payment_intent_id;
+	public $stripe_payment_hold_status;
+	public $stripe_customer_id;
+	public $edit_confirmation_code;
+
 	// Stores any errors found during the validation process
 	public $validation_errors = array();

@@ -132,10 +138,12 @@
 			'receipt_id' => '',
 			'discount_code' => '',
 			'payment_amount' => 0,
+			'order_total' => 0,
 			'subtotal' => 0,
 			'tax_amount' => 0,
 			'delivery_amount' => 0,
 			'tip_amount' => 0,
+			'discount_amount' => 0,
 			'estimated_time' => '24:00',
 			'permalink' => get_site_url(),
 			'custom_fields' => array()
--- a/food-and-drink-menu/includes/class-order-payments.php
+++ b/food-and-drink-menu/includes/class-order-payments.php
@@ -358,9 +358,16 @@

         		$order->post_status = 'fdm_order_received';

-        		$order->payment_amount = $fdm_controller->settings->get_setting( 'ordering-currency' ) != 'JPY' ? intval( $_POST['payment_amount'] ) / 100 : intval( $_POST['payment_amount'] );
+       			// load the stripe libraries
+				require_once( FDM_PLUGIN_DIR . '/lib/stripe/init.php' );

-        		$order->receipt_id = sanitize_text_field( $_POST['payment_id'] );
+				StripeStripe::setApiKey( $this->get_secret() );
+
+				$intent = StripePaymentIntent::retrieve( $order->stripe_payment_intent_id );
+
+				$order->payment_amount = $fdm_controller->settings->get_setting( 'ordering-currency' ) != 'JPY' ? $intent->amount / 100 : $intent->amount;
+
+				$order->receipt_id = $intent->id;

         		// Not needed anymore
         		unset( $order->stripe_payment_intent_id );
@@ -394,13 +401,41 @@
   	}

 	/**
-	 * Validate the payment success request by verifing the payment_intent ID
+	 * Validate the payment success request by verifying the payment_intent ID
 	 *
 	 * @return bool true on valid else false
 	 */
 	public function valid_payment( $order ) {
+		global $fdm_controller;
+
+		if ( empty( $order->stripe_payment_intent_id ) ) { return false; }
+
+		$posted_id = sanitize_text_field( $_POST['payment_id'] ?? '' );
+		if ( $posted_id !== $order->stripe_payment_intent_id ) { return false; }
+
+		try {
+
+			// load the stripe libraries
+			require_once( FDM_PLUGIN_DIR . '/lib/stripe/init.php' );
+
+			StripeStripe::setApiKey( $this->get_secret() );
+
+			$intent = StripePaymentIntent::retrieve( $order->stripe_payment_intent_id );
+
+			$is_hold = $fdm_controller->settings->get_setting( 'fdm-stripe-hold' );
+			$valid_status = $is_hold ? 'requires_capture' : 'succeeded';
+
+			return $intent->status === $valid_status;
+		}
+		catch ( Exception $ex ) {
+
+			if ( defined('WP_DEBUG') && WP_DEBUG ) {
+
+				error_log( sprintf( __( 'Five Star FDM Stripe valid_payment error: %s', 'food-and-drink-menu' ), $ex->getMessage() ) );
+			}

-    	return sanitize_text_field( $_POST['payment_id'] ) == $order->stripe_payment_intent_id;
+			return false;
+		}
   	}

 	/**
--- a/food-and-drink-menu/lib/stripe/lib/Collection.php
+++ b/food-and-drink-menu/lib/stripe/lib/Collection.php
@@ -116,6 +116,7 @@
      * @return ArrayIterator an iterator that can be used to iterate
      *    across objects in the current page
      */
+    #[ReturnTypeWillChange]
     public function getIterator()
     {
         return new ArrayIterator($this->data);
--- a/food-and-drink-menu/lib/stripe/lib/HttpClient/CurlClient.php
+++ b/food-and-drink-menu/lib/stripe/lib/HttpClient/CurlClient.php
@@ -498,7 +498,6 @@
     private function closeCurlHandle()
     {
         if (null !== $this->curlHandle) {
-            curl_close($this->curlHandle);
             $this->curlHandle = null;
         }
     }
--- a/food-and-drink-menu/lib/stripe/lib/StripeObject.php
+++ b/food-and-drink-menu/lib/stripe/lib/StripeObject.php
@@ -194,27 +194,32 @@
     }

     // ArrayAccess methods
+    #[ReturnTypeWillChange]
     public function offsetSet($k, $v)
     {
         $this->{$k} = $v;
     }

+    #[ReturnTypeWillChange]
     public function offsetExists($k)
     {
         return array_key_exists($k, $this->_values);
     }

+    #[ReturnTypeWillChange]
     public function offsetUnset($k)
     {
         unset($this->{$k});
     }

+    #[ReturnTypeWillChange]
     public function offsetGet($k)
     {
         return array_key_exists($k, $this->_values) ? $this->_values[$k] : null;
     }

     // Countable method
+    #[ReturnTypeWillChange]
     public function count()
     {
         return count($this->_values);
@@ -419,6 +424,7 @@
         }
     }

+    #[ReturnTypeWillChange]
     public function jsonSerialize()
     {
         return $this->toArray();
--- a/food-and-drink-menu/lib/stripe/lib/Util/CaseInsensitiveArray.php
+++ b/food-and-drink-menu/lib/stripe/lib/Util/CaseInsensitiveArray.php
@@ -21,16 +21,19 @@
         $this->container = array_change_key_case($initial_array, CASE_LOWER);
     }

+    #[ReturnTypeWillChange]
     public function count()
     {
         return count($this->container);
     }

+    #[ReturnTypeWillChange]
     public function getIterator()
     {
         return new ArrayIterator($this->container);
     }

+    #[ReturnTypeWillChange]
     public function offsetSet($offset, $value)
     {
         $offset = static::maybeLowercase($offset);
@@ -41,6 +44,7 @@
         }
     }

+    #[ReturnTypeWillChange]
     public function offsetExists($offset)
     {
         $offset = static::maybeLowercase($offset);
@@ -48,12 +52,14 @@
         return isset($this->container[$offset]);
     }

+    #[ReturnTypeWillChange]
     public function offsetUnset($offset)
     {
         $offset = static::maybeLowercase($offset);
         unset($this->container[$offset]);
     }

+    #[ReturnTypeWillChange]
     public function offsetGet($offset)
     {
         $offset = static::maybeLowercase($offset);
--- a/food-and-drink-menu/lib/stripe/lib/Util/Set.php
+++ b/food-and-drink-menu/lib/stripe/lib/Util/Set.php
@@ -37,6 +37,7 @@
         return array_keys($this->_elts);
     }

+    #[ReturnTypeWillChange]
     public function getIterator()
     {
         return new ArrayIterator($this->toArray());