{
 "id": "WPSEC-2026-1378",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1378/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1378/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1378/index.md",
 "title": "WP Booking System <= 2.1.0.4 - Authenticated (Subscriber+) Missing Authorization to Booking Modification via AJAX Actions",
 "description": "The WP Booking System plugin for WordPress is vulnerable to unauthorized access and modification of data via several booking management AJAX actions in all versions up to, and including, 2.1.0.4, due to a missing check that the current user may access the calendar a booking belongs to. The affected actions open booking details, email the customer, edit booking details and scheduled actions, and add or delete booking notes. This makes it possible for authenticated attackers, with Subscriber-level access and above, who have been given access to at least one calendar, to view and modify bookings that belong to calendars they are not allowed to access.",
 "plugin": {
  "slug": "wp-booking-system",
  "name": "WP Booking System",
  "full_name": "WP Booking System – Booking Calendar",
  "wordpress_org": "https://wordpress.org/plugins/wp-booking-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-booking-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-booking-system"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.1.0.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.1.0.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.1.0.5",
 "remediation": "Update to 2.1.0.5 or later.",
 "fix_released": "2026-10-19T10:22:15+00:00",
 "published": "2026-10-21T13:44:54+00:00",
 "updated": "2026-10-21T13:33:45.615122+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1378/",
  "https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.5/",
  "https://wordpress.org/plugins/wp-booking-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-booking-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}