CVE-2026-15151 Five Star Restaurant Reservations CVE debrief

Who should care

Administrators of WordPress sites using the Five Star Restaurant Reservations plugin should verify the plugin version and take necessary actions to mitigate the vulnerability. Site owners and security teams should review the plugin's functionality and ensure proper authorization checks are in place to prevent unauthorized changes to booking notification settings.

Technical summary

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role to reset the site's configured booking notification rules. This vulnerability could potentially allow unauthorized changes to booking notification settings. The plugin's code should be reviewed to identify the specific vulnerability and ensure proper authorization checks are in place.

Defensive priority

Administrators should verify the plugin version and restrict access to the booking-management role.

Recommended defensive actions

• Verify the plugin version and update to 2.7.23 or later
• Restrict access to the booking-management role
• Monitor for suspicious activity related to the Five Star Restaurant Reservations plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to determine the full scope of the vulnerability. The Five Star Restaurant Reservations WordPress plugin before 2.7.23 has a vulnerability allowing users with the lowest booking-management role to reset the site's configured booking notification rules due to a missing capability check on one of its AJAX actions. The plugin's functionality and potential impact on site security should be reviewed. Evidence is limited, and defenders should verify plugin versions and configurations.

Official resources