Booking Calendar plugin lets Editors read arbitrary WordPress options
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.
Summary
The Booking Calendar WordPress plugin from 10.15 before 11.8.3 does not restrict which options a settings handler loads. A user with the Editor role or above can disclose the values of arbitrary WordPress options, including core site configuration, which is tracked as CWE-200. An exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Booking Calendar | 10.15 to before 11.8.3 | 11.8.3 | Patch available | CNA |
- Booking Calendar VendorUnknown Affected 10.15 to before 11.8.3 Fixed in 11.8.3 Patch available CNA
Remediation
Update Booking Calendar to version 11.8.3, the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Booking Calendar (Unknown) Fixed in 11.8.3
Timeline
- 2026-10-08 Threatist record created from CVE-2026-105195
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences