What’s Vulnerable › Vulnerabilities

CVE-2026-116557: WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

Description

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.

Summary

WP Booking System – Booking Calendar plugin for WordPress through version 2.1.0.5 lacks a capability check in the wpbs_action_ajax_calendar_remove_note() function, allowing authenticated users with Subscriber-level access or higher to delete arbitrary calendar notes belonging to any calendar. With a CVSS score of 9.1, this is a critical unauthorized data modification flaw. It is not listed in CISA KEV and no exploitation has been reported. Update the plugin to a version later than 2.1.0.5 once available, and restrict user roles in the meantime.

تعاني إضافة WP Booking System – Booking Calendar لـ WordPress حتى الإصدار 2.1.0.5 من غياب التحقق من الصلاحيات في الدالة wpbs_action_ajax_calendar_remove_note()، مما يسمح للمستخدمين المصادق عليهم بمستوى Subscriber أو أعلى بحذف ملاحظات تقويم عشوائية تعود لأي تقويم. تُصنَّف الثغرة بدرجة خطورة 9.1 (حرجة) لأنها تتيح تعديل البيانات دون تصريح. لا ترد الثغرة في CISA KEV ولم يُبلَّغ عن استغلالها. يُنصح بالترقية إلى إصدار أحدث من 2.1.0.5 فور توفره، وتقييد أدوار المستخدمين كإجراء مؤقت.

Affected products

References

Get alerted when CVE-2026-116557 or the next vulnerability affects your stack