CVE-2026-15151 Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications
Low-privilege users can reset booking notification rules due to missing capability checks in the Five Star Restaurant Reservations plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15151?
CVE-2026-15151 is a high-severity missing authorization vulnerability in Unknown Five Star Restaurant Reservations, published on 2 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
Weakness: CWE-284
Which versions are affected by CVE-2026-15151?
How do I fix CVE-2026-15151?
No fix has been published for CVE-2026-15151 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-15151 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15151 exists.
Sources
Also known as GHSA-cqrw-r722-x7xp.