CVE-2026-15151 is an improper access control vulnerability (CWE-284) in the Five Star Restaurant Reservations WordPress plugin versions prior to 2.7.23. The plugin fails to perform a capability check on one of its AJAX actions, enabling users with minimal booking-management privileges to reset booking notification rules that should be restricted. This vulnerability could allow unauthorized modification of booking notification configurations without requiring elevated privileges or user interaction.

An attacker with the lowest booking-management role can reset the site's booking notification rules, potentially disrupting notification workflows. The vulnerability does not allow privilege escalation beyond this role or impact data confidentiality or availability directly. The CVSS 3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented at this time. Until a patch is available, restrict booking-management roles to trusted users only and monitor for unauthorized changes to booking notification settings.