CVE-2026-15151CWE-284broken-access-control

CVE-2026-15151

High · published August 2, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
32.4
In the wild
Unconfirmed
What it is

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00394 · 32.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-02T10:16Z
References (1)
https://wpscan.com/vulnerability/2c28e8b9-4293-4cf4-990d-09727275935b/ · [email protected]
EPSS history
Timeline
  • 02 AUG 06:00Z
    Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications
    cvelistv5