WP Booking System - Booking Calendar unauthorized data modification (CVE-2026-116557)
The WP Booking System - Booking Calendar plugin contains a vulnerability in the wpbs_action_ajax_calendar_remove_note function that allows authenticated users to delete arbitrary calendar notes due to a missing capability check.
CVE search metadata
CVE search record: CVE-2026-116557. Severity: critical. CVSS: 9.1. KEV: no. Product: WP Booking System - Booking Calendar (<= 2.1.0.5). Brief: WP Booking System - Booking Calendar unauthorized data modification (CVE-2026-116557). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wp-booking-plugin-auth-bypass/
Triage facts
Revision 1- Applicability
- WP Booking System - Booking Calendar (<= 2.1.0.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 07:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5. This allows authenticated attackers with Subscriber-level access or higher to delete arbitrary calendar notes.