Live › vulnerability › CVE-2026-116557
The WP Booking System Booking Calendar plugin for WordPress lacks a capability check on its calendar note removal function in versions up to and including 2.1.0.5. An authenticated attacker with Subscriber-level access can delete arbitrary calendar notes belonging to any calendar.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the WP Booking System - Booking Calendar plugin at version 2.1.0.5 or lower where users can register or hold Subscriber-level accounts. The flaw is a missing capability check, so the attacker needs a logged-in account but no elevated role. Sites without this plugin, or with it updated past the affected range, are not exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wp-booking-system | wordpress | <= 2.1.0.5 | 2.1.0.6 |
2.1.0.5 or lower, you are exposedUpdate WP Booking System - Booking Calendar to or later ( is current on wordpress.org).
2.1.0.62.1.0.7Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.
This page as .md · .json · in your agent: get_signal("CVE-2026-116557")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.