CVE-2026-15151

Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.

Affected

Five Star Restaurant Reservations

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 32nd percentile

Published

2026-08-02

Updated

2026-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/2c28e8b9-4293-4cf4-990d-09727275935b/

References

• CVE Record
• NVD entry