{"id":"CVE-2026-116557","published":"2026-10-31T07:16:35.857","lastModified":"2026-10-31T07:16:35.857","description":"The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L111","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L119","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L123","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3765778/wp-booking-system/trunk/includes/base/admin/calendar/functions-notes.php","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?old=3755940&old_path=%2Fwp-booking-system%2Ftrunk&new=3765778&new_path=%2Fwp-booking-system%2Ftrunk","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25cc768-3377-41c9-acf5-8f6c993287c9?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP Booking System plugin for WordPress lacks a capability check on its calendar note removal endpoint, allowing any authenticated user with Subscriber access or higher to delete arbitrary calendar notes belonging to any calendar.","exploitability":"Exploitation is straightforward for authenticated attackers with at least Subscriber privileges, as no additional authentication or privilege escalation is required beyond valid credentials.","blast_radius":"An attacker could disrupt business operations by deleting critical calendar notes across multiple calendars, potentially erasing appointment reminders, availability constraints, or other essential scheduling data.","remediation":"Upgrade to version 2.1.0.6 or later, where the missing capability check has been fixed.","detection":"Look for AJAX requests to wpbs_action_ajax_calendar_remove_note with valid user session cookies but originating from users lacking administrative or calendar management capabilities; no specific log field or unique artefact is described in the CVE.","tags":["missing-capability-check","unauthorized-deletion","wordpress-plugin","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:50:22.953Z"}}