# WP Booking System – Booking Calendar <= 2.1.0.7 - Authenticated (Calendar-Assigned User+) Missing Authorization to Arbitrary Booking Deletion

- **ID:** WPSEC-2026-2772
- **Plugin:** WP Booking System – Booking Calendar (`wp-booking-system`), https://wordpress.org/plugins/wp-booking-system/
- **Affected versions:** from 2.1 before 2.1.0.8
- **Fixed in:** 2.1.0.8 (Update to 2.1.0.8 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-booking-system
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2772/

## Description

The WP Booking System plugin for WordPress is vulnerable to unauthorized data deletion via the 'permanently_delete_booking' and 'permanently_delete_all_bookings' admin actions in all versions up to, and including, 2.1.0.7, due to a missing check that the current user may access the calendar of the targeted booking or calendar. The handlers verify only a nonce that is not tied to a specific calendar, and the single-booking handler trusts the booking_id and calendar_id request parameters. This makes it possible for authenticated attackers who have been granted access to at least one calendar to permanently delete individual bookings, or all trashed bookings, of calendars they are not permitted to manage.

## References

- https://wpsec.com/vuln/WPSEC-2026-2772/
- https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.8/
- https://wordpress.org/plugins/wp-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2772/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.