CVE-2026-15151: Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Five Star Restaurant Reservations (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.7.23 - Compensating control
Restrict access to the WordPress site actions that invoke the booking-notification AJAX reset (those affected by rtb_reset_notifications) to authorized admins/booking-managers with the required capability, until the plugin is upgraded to 2.7.23.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15151?
The severity of CVE-2026-15151 is classified as risk 37.
How do I fix CVE-2026-15151?
To fix CVE-2026-15151, update the Five Star Restaurant Reservations WordPress plugin to version 2.7.23 or later.
What is the impact of CVE-2026-15151?
CVE-2026-15151 allows users with low-level booking-management roles to execute certain AJAX actions without proper authorization.
Which software versions are affected by CVE-2026-15151?
CVE-2026-15151 affects the Five Star Restaurant Reservations WordPress plugin versions prior to 2.7.23.
What type of vulnerability is CVE-2026-15151?
CVE-2026-15151 is an authorization vulnerability in the booking management functionality of the plugin.