# Booking System <= 2.1.0.6 - Unauthenticated Booking Restriction Bypass via Form Parameter Tampering

- **ID:** WPSEC-2026-2068
- **Plugin:** WP Booking System – Booking Calendar (`wp-booking-system`), https://wordpress.org/plugins/wp-booking-system/
- **Affected versions:** all versions before 2.1.0.7
- **Fixed in:** 2.1.0.7 (Update to 2.1.0.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-472
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-booking-system
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2068/

## Description

The WP Booking System plugin for WordPress is vulnerable to Booking Restriction Bypass via the 'wpbs_submit_form' and 'wpbs_validate_date_selection' AJAX actions in all versions up to, and including, 2.1.0.6, due to the handlers building the booking restriction arguments (auto pending, minimum and maximum days, booking start and end day, selection type and style) from the visitor-submitted form data instead of the values the site owner configured, and not rejecting bookings that start in the past. This makes it possible for unauthenticated attackers to bypass the site's booking rules, such as making their booking automatically block calendar dates when automatic blocking is disabled, ignoring minimum or maximum stay and required start or end weekdays, or booking dates in the past.

## References

- https://wpsec.com/vuln/WPSEC-2026-2068/
- https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.7/
- https://wordpress.org/plugins/wp-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2068/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.