{"id":"CVE-2026-116557","kind":"vulnerability","aliases":["CVE-2026-116557"],"related":[],"title":"WP Booking System plugin: any logged-in subscriber can delete calendar notes","description":"The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.","summary":"The WP Booking System Booking Calendar plugin for WordPress lacks a capability check on its calendar note removal function in versions up to and including 2.1.0.5. An authenticated attacker with Subscriber-level access can delete arbitrary calendar notes belonging to any calendar.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-booking-system","fixed":["2.1.0.6"],"affected":"<= 2.1.0.5","ecosystem":"wordpress"}],"ecosystems":[],"tags":["authenticated","booking-calendar","package","wordpress","wordpress-plugin","wp-booking-system"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed"],"how_to_check":"WordPress admin > Plugins: if WP Booking System - Booking Calendar is 2.1.0.5 or lower, you are exposed. WP-CLI: wp plugin get wp-booking-system --field=version","fix":"Update WP Booking System - Booking Calendar to 2.1.0.6 or later (2.1.0.7 is current on wordpress.org).","status":"open","published_at":"2026-10-31T07:16:35+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:24+00:00","updated_at":"2026-10-31T07:35:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-31T07:34:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Booking System plugin: any logged-in subscriber can delete calendar notes","impact":"medium","summary":"The WP Booking System Booking Calendar plugin for WordPress lacks a capability check on its calendar note removal function in versions up to and including 2.1.0.5. An authenticated attacker with Subscriber-level access can delete arbitrary calendar notes belonging to any calendar.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-booking-system","booking-calendar"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker deletes calendar notes belonging to any calendar","analyst_note":"Confirm the patched plugin version and whether the vendor has released a fix; the NVD entry in the sources does not state one.","how_to_check":"- Check the installed version of the WP Booking System - Booking Calendar plugin (WordPress admin, Plugins page) and see whether it is `2.1.0.5` or lower\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-accounts"],"who_is_affected":"Sites running the WP Booking System - Booking Calendar plugin at version 2.1.0.5 or lower where users can register or hold Subscriber-level accounts. The flaw is a missing capability check, so the attacker needs a logged-in account but no elevated role. Sites without this plugin, or with it updated past the affected range, are not exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000707,"input_tokens":4166,"output_tokens":581,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the patched plugin version and whether the vendor has released a fix; the NVD entry in the sources does not state one.","search":"'-116557':16A,19A '-2026':15A,18A '2.1.0.5':62B,117C 'access':70B,129C 'action':105C 'ajax':106C 'arbitrari':73B,134C 'attack':65B,124C 'authent':24B,64B,123C 'belong':76B,137C 'book':2A,26B,35B,39B,41B,82C,84C 'booking':22A 'booking-calendar':25B 'calendar':12A,27B,42B,52B,74B,79B,85C,107C,135C,140C 'capabl':48B,100C 'check':49B,101C 'cve':14A,17A 'data':95C 'delet':11A,72B,133C 'due':96C 'function':55B,110C 'includ':61B,116C 'lack':46B 'level':69B,128C 'log':7A 'logged-in':6A 'make':119C 'miss':99C 'modif':93C 'note':13A,53B,75B,109C,136C 'packag':28B 'plugin':4A,32B,43B,86C 'possibl':121C 'remov':54B,108C 'subscrib':9A,68B,127C 'subscriber-level':67B,126C 'system':3A,23A,36B,40B,83C 'unauthor':92C 'version':57B,112C 'vulner':90C 'wordpress':29B,31B,45B,88C 'wordpress-plugin':30B 'wp':1A,21A,34B,38B,81C 'wp-booking-system':20A,33B 'wpbs':104C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Booking System - Booking Calendar plugin at version 2.1.0.5 or lower where users can register or hold Subscriber-level accounts. The flaw is a missing capability check, so the attacker needs a logged-in account but no elevated role. Sites without this plugin, or with it updated past the affected range, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116557","severity":null,"published_at":"2026-10-31T07:16:35+00:00","modified_at":"2026-10-31T07:16:35+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116557:1222","url":null,"severity":null,"published_at":"2026-10-31T07:35:53+00:00","modified_at":"2026-10-31T07:35:53+00:00","first_seen_at":"2026-10-31T07:35:53+00:00","fetched_at":"2026-10-31T07:35:53+00:00","note":"Patched in 2.1.0.6 per Patchstack; wordpress.org changelog lists 2.1.0.6 as 'security improvements' without naming the CVE, so fix not marked verified. 2.1.0.7 is current. Severity discrepancy: NVD/Wordfence 9.1 (vector says PR:N) vs Patchstack 5.4 low priority; needs Subscriber login per description; left severity unchanged. No exploitation or PoC found."}],"documents":[{"id":30299,"url":"https://wordpress.org/plugins/wp-booking-system/","title":"WP Booking System changelog (wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":30300,"url":"https://patchstack.com/database/wordpress/plugin/wp-booking-system/vulnerability/wordpress-wp-booking-system-booking-calendar-plugin-2-1-0-5-missing-authorization-to-unauthenticated-arbitrary-calendar-note-deletion-vulnerability","title":"Patchstack: WP Booking System <= 2.1.0.5 Broken Access Control","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}