Booking System <= 2.1.0.6 - Unauthenticated Booking Restriction Bypass via Form Parameter Tampering
- ID
- WPSEC-2026-2068
- Plugin
- WP Booking System – Booking Calendar (wp-booking-system)
- Affected
- all versions before 2.1.0.7
- Remediation
- Update to 2.1.0.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Booking System on WPSec AttackSurface
- Fix released
- Published
Description
The WP Booking System plugin for WordPress is vulnerable to Booking Restriction Bypass via the 'wpbs_submit_form' and 'wpbs_validate_date_selection' AJAX actions in all versions up to, and including, 2.1.0.6, due to the handlers building the booking restriction arguments (auto pending, minimum and maximum days, booking start and end day, selection type and style) from the visitor-submitted form data instead of the values the site owner configured, and not rejecting bookings that start in the past. This makes it possible for unauthenticated attackers to bypass the site's booking rules, such as making their booking automatically block calendar dates when automatic blocking is disabled, ignoring minimum or maximum stay and required start or end weekdays, or booking dates in the past.
References
- https://wpsec.com/vuln/WPSEC-2026-2068/
- https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.7/
- https://wordpress.org/plugins/wp-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS