WP Booking System - Booking Calendar (<= 2.1.0.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp-booking-system---booking-calendar--2.1.0.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:51:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWP Booking System - Booking Calendar unauthorized data modification (CVE-2026-116557)https://feed.craftedsignal.io/briefs/2026-10-wp-booking-plugin-auth-bypass/Sat, 31 Oct 2026 07:51:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wp-booking-plugin-auth-bypass/The WP Booking System - Booking Calendar plugin contains a vulnerability in the wpbs_action_ajax_calendar_remove_note function that allows authenticated users to delete arbitrary calendar notes due to a missing capability check.<p>The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5. This allows authenticated attackers with Subscriber-level access or higher to delete arbitrary calendar notes.</p> highadvisory