CVE-2026-15151: CWE-284 Improper Access Control in Five Star Restaurant Reservations
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
AI Analysis
Technical Summary
CVE-2026-15151 is an improper access control vulnerability (CWE-284) in the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. The plugin fails to perform a capability check on one of its AJAX actions, enabling users with minimal booking-management privileges to reset configured booking notification rules. This bypasses intended access restrictions on plugin settings.
Potential Impact
Users with the lowest booking-management role can reset booking notification rules, potentially disrupting notification configurations. This could lead to denial of service or misconfiguration of booking alerts but does not allow direct access to other plugin settings or broader site control based on the provided data.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should monitor the vendor advisory for updates and apply any forthcoming patches promptly. Until then, review and restrict user roles and permissions related to booking management to minimize exposure.
CVE-2026-15151: CWE-284 Improper Access Control in Five Star Restaurant Reservations
Description
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15151 is an improper access control vulnerability (CWE-284) in the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. The plugin fails to perform a capability check on one of its AJAX actions, enabling users with minimal booking-management privileges to reset configured booking notification rules. This bypasses intended access restrictions on plugin settings.
Potential Impact
Users with the lowest booking-management role can reset booking notification rules, potentially disrupting notification configurations. This could lead to denial of service or misconfiguration of booking alerts but does not allow direct access to other plugin settings or broader site control based on the provided data.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should monitor the vendor advisory for updates and apply any forthcoming patches promptly. Until then, review and restrict user roles and permissions related to booking management to minimize exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-08T19:34:08.416Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6f99c9bf32cb7a344bda08
Added to database: 08/02/2026, 19:26:01 UTC
Last enriched: 08/02/2026, 19:27:22 UTC
Last updated: 08/02/2026, 23:32:08 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.