WP Booking System – Booking Calendar <= 2.1.0.7 - Authenticated (Calendar-Assigned User+) Missing Authorization to Arbitrary Booking Deletion
- ID
- WPSEC-2026-2772
- Plugin
- WP Booking System – Booking Calendar (wp-booking-system)
- Affected
- from 2.1 before 2.1.0.8
- Remediation
- Update to 2.1.0.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-10
- Attack surface
- WP Booking System – Booking Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The WP Booking System plugin for WordPress is vulnerable to unauthorized data deletion via the 'permanently_delete_booking' and 'permanently_delete_all_bookings' admin actions in all versions up to, and including, 2.1.0.7, due to a missing check that the current user may access the calendar of the targeted booking or calendar. The handlers verify only a nonce that is not tied to a specific calendar, and the single-booking handler trusts the booking_id and calendar_id request parameters. This makes it possible for authenticated attackers who have been granted access to at least one calendar to permanently delete individual bookings, or all trashed bookings, of calendars they are not permitted to manage.
References
- https://wpsec.com/vuln/WPSEC-2026-2772/
- https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.8/
- https://wordpress.org/plugins/wp-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS