{
 "id": "WPSEC-2026-2068",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2068/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2068/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2068/index.md",
 "title": "Booking System <= 2.1.0.6 - Unauthenticated Booking Restriction Bypass via Form Parameter Tampering",
 "description": "The WP Booking System plugin for WordPress is vulnerable to Booking Restriction Bypass via the 'wpbs_submit_form' and 'wpbs_validate_date_selection' AJAX actions in all versions up to, and including, 2.1.0.6, due to the handlers building the booking restriction arguments (auto pending, minimum and maximum days, booking start and end day, selection type and style) from the visitor-submitted form data instead of the values the site owner configured, and not rejecting bookings that start in the past. This makes it possible for unauthenticated attackers to bypass the site's booking rules, such as making their booking automatically block calendar dates when automatic blocking is disabled, ignoring minimum or maximum stay and required start or end weekdays, or booking dates in the past.",
 "plugin": {
  "slug": "wp-booking-system",
  "name": "Booking System",
  "full_name": "WP Booking System – Booking Calendar",
  "wordpress_org": "https://wordpress.org/plugins/wp-booking-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-booking-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-booking-system"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-472"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.1.0.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.1.0.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.1.0.7",
 "remediation": "Update to 2.1.0.7 or later.",
 "fix_released": "2026-10-29T13:05:10+00:00",
 "published": "2026-10-30T13:53:52+00:00",
 "updated": "2026-10-29T17:43:29.708949+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2068/",
  "https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.7/",
  "https://wordpress.org/plugins/wp-booking-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-booking-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}