What’s Vulnerable › Vulnerabilities
CVE-2026-105195: Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
- Severity: low (CVSS 2.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-08 · updated 2026-10-08
- Weakness: CWE-200
Description
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
Affected products
- Booking Calendar: from 10.15 before 11.8.3 — fixed in 11.8.3
How to fix
Upgrade to a fixed version: Booking Calendar 11.8.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-105195 or the next vulnerability affects your stack