The Five Star Restaurant Reservations WordPress plugin before 2.7.23 fails to perform a capability check on the AJAX action rtb_reset_notifications. As a result, users granted the lowest booking‑management role, who normally cannot access plugin settings, can reset the site’s configured booking notification rules. This weakness allows an attacker with a legitimate user account to alter notification email templates, destinations, or disable alerts, potentially leading to missed reservations, customer confusion, or loss of revenue. The flaw represents an improper authorization issue, aligned with CWE‑284.

All installations of the Five Star Restaurant Reservations plugin with a version older than 2.7.23 are affected. The vulnerability applies to any WordPress site that has not yet upgraded the plugin past this version and uses the default booking‑management role.

The EPSS score is reported as less than 1 % and the issue is not listed in CISA’s KEV catalog, indicating a low probability of widespread exploitation. However, the flaw can be triggered remotely by any authenticated user with the booking‑management role through an AJAX request, without requiring additional privileges or system access. Because the attacker is already authenticated, the practical impact is limited to configuration changes rather than full system compromise. The CVSS score of 7.5 indicates high severity, reflecting the potential impact that the attacker can impose through configuration changes.