Missing authorization in WP Booking System allows note deletion
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The WP Booking System (Booking Calendar) plugin for WordPress is affected up to and including 2.1.0.5. A missing capability check (CWE-862) in the wpbs_action_ajax_calendar_remove_note function lets authenticated attackers delete calendar notes belonging to any calendar. Attackers need only Subscriber-level access or above.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| murgroland | WP Booking System – Booking Calendar | up to 2.1.0.5 | — | No fix listed | CNA |
- WP Booking System – Booking Calendar Vendormurgroland Affected up to 2.1.0.5 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for WP Booking System (Booking Calendar).
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Timeline
- 2026-10-31 Threatist record created from CVE-2026-116557
- 2026-10-31 Alias added: GHSA-wwrg-9g45-mxcv
- 2026-11-01 Priority changed: MEDIUM → LOW
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → MEDIUM
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b25cc768-3377-41c9-acf5-8f6c993287c9?source=cve
- https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L123
- https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L119
- https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L111
- https://plugins.trac.wordpress.org/changeset?old=3755940&old_path=%2Fwp-booking-system%2Ftrunk&new=3765778&new_path=%2Fwp-booking-system%2Ftrunk
- https://plugins.trac.wordpress.org/changeset/3765778/wp-booking-system/trunk/includes/base/admin/calendar/functions-notes.php
More murgroland vulnerabilities
- TI-2026-76013 Missing authorization in WP Booking System exposes booking emails CVSS 3.1HIGH 7.5
- TI-2026-76022 Missing authorization in WP Booking System allows access escalation CVSS 3.1MEDIUM 6.8
- TI-2026-76021 Missing authorization in WP Booking System exposes booking data CVSS 3.1MEDIUM 6.5
- TI-2026-70283 SQL injection in WP Booking System WordPress plugin CVSS 3.1MEDIUM 6.5
- TI-2026-75287 SQL injection in WP Booking System plugin via orderby parameter CVSS 3.1MEDIUM 4.9
Sources
- CVE-2026-116557 · CVE Program
- CVE-2026-116557 · NVD
- FIRST EPSS
- GHSA-wwrg-9g45-mxcv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences