CVE-2026-15151
Last modified
CVE-2026-15151 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Five Star Restaurant Reservations | < 2.7.23 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-15151?
How severe is CVE-2026-15151?
How do I fix CVE-2026-15151?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-15145The Essential Addons for Elementor – Popular Elementor Templ…6.4
- CVE-2026-15146GNU Wget does not validate the IP address provided by an FTP…5.9
- CVE-2026-15147The Five Star Restaurant Reservations WordPress plugin befor…5.3
- CVE-2026-15148The WP Events Manager WordPress plugin before 2.2.5 does not…5.3
- CVE-2026-15149The WP Hotel Booking WordPress plugin before 2.3.3 does not …5.3
- CVE-2026-15150The myCred WordPress plugin before 3.2.5 does not verify tha…5.3
- CVE-2026-15152The WP Hotel Booking WordPress plugin before 2.3.2 does not …5.3
- CVE-2026-15153The WP Hotel Booking WordPress plugin before 2.3.2 does not …6.8
- CVE-2026-15154A flaw was found in `guardrails-detectors`, a component of R…6.5
- CVE-2026-15155The Essential Addons for Elementor – Popular Elementor Templ…8.8
- CVE-2026-15156The Essential Addons for Elementor – Popular Elementor Templ…6.4
- CVE-2026-15157undici does not validate the type property of a duck-typed b…5.4
Are you affected by CVE-2026-15151?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST