CVE-2026-15151

This vulnerability exposes a deliberate access control boundary that was implemented inconsistently. The plugin defines a booking-manager role specifically designed to restrict users from accessing plugin settings — a reasonable requirement for restaurants that need staff to manage individual reservations without reconfiguring the system. However, an AJAX handler exists that allows this role to reset all notification rules, bypassing the capability check entirely. The CVSS 7.5 score badly misrepresents the actual operational impact. When you reset notification rules, you're wiping every email template, SMS notification, reservation confirmation, and reminder schedule simultaneously. For a restaurant running 200+ reservations, this means manually contacting every affected customer or losing bookings outright. The blast radius extends beyond the plugin: downstream systems expecting confirmation emails, kitchen displays waiting for table-ready alerts, and third-party integrations that interpret silence as cancellation all get affected. The fix is straightforward — add a capability check and nonce verification to the affected AJAX handler — but the real issue is architectural. The role system was implemented as a layer over menu visibility without corresponding enforcement on server-side actions. Every new AJAX endpoint added to this plugin represents potential capability coverage gaps. You should audit other AJAX handlers in this plugin against the capability matrix, not just page-level access controls. Two practical steps: first, verify whether your booking-manager role is assigned to anyone with elevated frustration or external access (temporary staff, third-party reservation services, franchise operators); second, confirm whether the patch has been applied and test that the reset handler now correctly denies permission. If the plugin is abandoned or unmaintained, you need a manual code audit of all admin-ajax.php callbacks.

Reviewed through automated stages and approved by a human before publication.