---
id: "CVE-2026-116557"
kind: "vulnerability"
aliases: ["CVE-2026-116557"]
title: "WP Booking System plugin: any logged-in subscriber can delete calendar notes"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-booking-system", "fixed": ["2.1.0.6"], "affected": "<= 2.1.0.5", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["authenticated", "booking-calendar", "package", "wordpress", "wordpress-plugin", "wp-booking-system"]
not_affected_if: ["no-subscriber-accounts", "plugin-not-installed"]
published_at: "2026-10-31T07:16:35+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:35:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116557", "first_seen_at": "2026-10-31T07:34:07+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T07:35:53+00:00"}]
---

# WP Booking System plugin: any logged-in subscriber can delete calendar notes

The WP Booking System Booking Calendar plugin for WordPress lacks a capability check on its calendar note removal function in versions up to and including 2.1.0.5. An authenticated attacker with Subscriber-level access can delete arbitrary calendar notes belonging to any calendar.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-booking-system affected <= 2.1.0.5 fixed 2.1.0.6

## How to check

WordPress admin > Plugins: if WP Booking System - Booking Calendar is 2.1.0.5 or lower, you are exposed. WP-CLI: wp plugin get wp-booking-system --field=version

## Fix

Update WP Booking System - Booking Calendar to 2.1.0.6 or later (2.1.0.7 is current on wordpress.org).

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116557
- 2026-10-31T07:35:53+00:00 analyst — Patched in 2.1.0.6 per Patchstack; wordpress.org changelog lists 2.1.0.6 as 'security improvements' without naming the CVE, so fix not marked verified. 2.1.0.7 is current. Severity discrepancy: NVD/Wordfence 9.1 (vector says PR:N) vs Patchstack 5.4 low priority; needs Subscriber login per description; left severity unchanged. No exploitation or PoC found.

## Documents

- [advisory] Patchstack: WP Booking System <= 2.1.0.5 Broken Access Control https://patchstack.com/database/wordpress/plugin/wp-booking-system/vulnerability/wordpress-wp-booking-system-booking-calendar-plugin-2-1-0-5-missing-authorization-to-unauthenticated-arbitrary-calendar-note-deletion-vulnerability
- [fix] WP Booking System changelog (wordpress.org) https://wordpress.org/plugins/wp-booking-system/

## From the sources

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_