WordPress Plugin Privilege Escalation via Unprotected AJAX Actions

The Five Star Restaurant Reservations WordPress plugin contains a privilege escalation vulnerability where AJAX actions lack proper capability checks. This allows users with minimal booking-management role permissions to reset critical site configuration—specifically notification rules—despite lacking administrative access. WordPress site owners using this plugin are at risk, as attackers with low-level accounts can manipulate booking notification settings, potentially disrupting business operations, enabling phishing attacks through altered notifications, or causing denial of service. The vulnerability affects versions before 2.7.23, making it a common attack vector for privilege escalation campaigns targeting WordPress installations.

While this specific CVE maps to CWE-284 (Improper Access Control) rather than discrete MITRE ATT&CK techniques, Casky's skill library would detect attack patterns associated with T1548 (Abuse Elevation Control Mechanism) and T1078 (Valid Accounts) through behavioral analysis. Practitioners using Casky would observe suspicious AJAX requests from low-privileged accounts targeting admin-level functions, anomalous configuration changes without corresponding administrative actions, and role-permission mismatches in audit logs. Extended reasoning across Casky's 754 security skills enables detection of the access control bypass pattern—identifying when unauthenticated or minimally-privileged actions trigger functions reserved for higher roles—allowing security teams to flag this exploitation technique before malicious configuration changes occur.