EUVD-2026-51932
GHSA-cqrw-r722-x7xp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Requires authenticated booking-management role (PR:L, not PR:N); impact is notification rule reset - an integrity concern only, with no confidentiality or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
AnalysisAI
Missing capability check on a WordPress AJAX action in Five Star Restaurant Reservations before 2.7.23 permits any user holding the plugin's lowest booking-management role to reset the site's configured booking notification rules - a setting they are explicitly barred from accessing through the UI. Notably, the provided CVSS vector (PR:N, C:H) conflicts materially with the description, which requires an authenticated role and describes an integrity-only impact; defenders should not rely on the published score at face value. A publicly available exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates no meaningful opportunistic exploitation has been observed.
Technical ContextAI
The root cause is CWE-284 (Improper Access Control), specifically the omission of a WordPress capability check on a registered AJAX action handler. In WordPress, actions registered via wp_ajax_ hooks are available to any authenticated session unless the handler explicitly calls current_user_can() with the appropriate capability slug. The Five Star Restaurant Reservations plugin defines a booking-management role hierarchy; the lowest tier is intended to be scoped away from plugin settings, but the unprotected AJAX endpoint bypasses that scoping entirely. The affected product is enumerated under CPE cpe:2.3:a:unknown:five_star_restaurant_reservations:*:*:*:*:*:*:*:*, covering all releases before 2.7.23. The vulnerability was discovered and reported by WPScan.
RemediationAI
Update the Five Star Restaurant Reservations WordPress plugin to version 2.7.23 or later, which introduces the missing capability check on the affected AJAX action handler; this is confirmed as the vendor-released patch per WPScan advisory https://wpscan.com/vulnerability/2c28e8b9-4293-4cf4-990d-09727275935b/. As a compensating control prior to patching, administrators should audit which WordPress accounts hold the plugin's booking-management role and remove it from any accounts that do not strictly require it - note this may impair legitimate reservation management for part-time or external staff. Restricting access to wp-admin/admin-ajax.php to known IP ranges at the WAF or server level would further reduce exposure, with the trade-off of preventing remote reservation management. Generic WordPress hardening (disabling XML-RPC, enforcing MFA on admin accounts) does not address this specific AJAX bypass.
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a
Missing authorization in the Five Star Restaurant Reservations WordPress plugin (version 2.7.19 and earlier) lets remote
Information disclosure in the Five Star Restaurant Reservations WordPress plugin (versions up to and including 2.7.14) a
Rustaurius Five Star Restaurant Reservations through version 2.7.9 contains an authorization bypass vulnerability that a
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today