CVE-2026-15151: Five Star Restaurant Auth Bypass Flaw

CVE-2026-15151 Overview

CVE-2026-15151 is a broken access control vulnerability in the Five Star Restaurant Reservations WordPress plugin before version 2.7.23. The plugin fails to perform a capability check on one of its AJAX actions. This omission allows users with the lowest booking-management role, who cannot normally access the plugin's settings, to reset the site's configured booking notification rules. The flaw is categorized under [CWE-284] Improper Access Control and carries a CVSS 3.1 base score of 7.5. Exploitation requires network access but no privileges beyond the lowest booking-management role, and no user interaction.

Critical Impact
Authenticated low-privilege users can reset booking notification rules, disrupting restaurant reservation workflows and potentially preventing legitimate notifications from being delivered.

Affected Products

Five Star Restaurant Reservations WordPress plugin versions prior to 2.7.23
WordPress sites using the plugin with multiple booking-management users
Restaurant sites relying on the plugin's notification configuration

Discovery Timeline

2026-08-02 - CVE-2026-15151 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15151

Vulnerability Analysis

The Five Star Restaurant Reservations plugin exposes an AJAX endpoint that handles booking notification rule configuration. The endpoint validates that a request originates from an authenticated user but does not check whether that user holds the capability required to modify plugin settings. As a result, any user assigned the lowest booking-management role can invoke the action and reset notification rules.

The vulnerability represents a horizontal-to-vertical privilege escalation within the plugin's role model. Booking-management users are expected to view or manage reservations, not alter site-wide configuration. Bypassing the capability check collapses this boundary.

Because the affected action modifies configuration without confidentiality or availability impact to the underlying WordPress site, the CVSS vector reflects impact on integrity of the plugin's configured state via the notification ruleset reset.

Root Cause

The root cause is a missing current_user_can() capability check on the AJAX handler. WordPress requires plugins to enforce capability checks server-side because nonces alone authenticate the request source, not the user's authorization level. The plugin's handler proceeds directly to reset logic once the request passes nonce validation.

Attack Vector

An attacker with valid credentials for the lowest booking-management role sends a crafted admin-ajax.php POST request containing the vulnerable action name and a valid nonce obtained from any authenticated session. The server executes the reset without verifying that the caller has settings-management privileges. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-15151

Indicators of Compromise

Unexpected changes or resets to the Five Star Restaurant Reservations notification rule configuration
admin-ajax.php POST requests from low-privilege booking accounts targeting plugin-specific actions
Absence of booking notification emails after previously working configurations

Detection Strategies

Enable WordPress audit logging to capture plugin settings modifications and correlate them with the acting user's role
Alert on AJAX action invocations from user accounts that lack administrative capability but access settings-related endpoints
Compare current notification rule state against a known-good baseline on a scheduled interval

Monitoring Recommendations

Monitor web server access logs for POST /wp-admin/admin-ajax.php calls containing the plugin's action parameter from non-administrator sessions
Track authentication events for users holding the lowest booking-management role
Review plugin update status across managed WordPress deployments to identify hosts still running versions below 2.7.23

How to Mitigate CVE-2026-15151

Immediate Actions Required

Update the Five Star Restaurant Reservations plugin to version 2.7.23 or later on all WordPress installations
Audit user accounts assigned booking-management roles and remove unnecessary access
Export and back up current notification rule configurations before applying updates

Patch Information

The vendor addressed CVE-2026-15151 in Five Star Restaurant Reservations version 2.7.23 by adding the missing capability check to the affected AJAX action. Site administrators should apply this update through the WordPress plugin dashboard or via WP-CLI. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily restrict access to admin-ajax.php for low-privilege accounts using a web application firewall rule
Remove the booking-management role from untrusted users until the patch is applied
Disable the plugin until an update can be scheduled on production sites

bash

# Update the plugin using WP-CLI
wp plugin update five-star-restaurant-reservations --version=2.7.23
wp plugin list --name=five-star-restaurant-reservations --field=version