Vulnerabilities / WP Booking System – Booking Calendar / WPSEC-2026-2773
WP Booking System – Booking Calendar <= 2.1.0.7 - Authenticated (Calendar-Assigned User+) Missing Authorization to Legend Item Deletion
Medium 4.3
CWE-862Fixed in 2.1.0.8
- ID
- WPSEC-2026-2773
- Plugin
- WP Booking System – Booking Calendar (wp-booking-system)
- Affected
- from 2.1 before 2.1.0.8
- Remediation
- Update to 2.1.0.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-10
- Attack surface
- WP Booking System – Booking Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The WP Booking System plugin for WordPress is vulnerable to unauthorized modification of data via the 'delete_legend_item' admin action in all versions up to, and including, 2.1.0.7, due to a missing calendar access check in the wpbs_action_delete_legend_item function, which verifies only a nonce that is not tied to a specific calendar before deleting the legend item identified by the legend_item_id parameter. This makes it possible for authenticated attackers who have been granted access to at least one calendar to delete legend items belonging to calendars they are not permitted to manage.
References
- https://wpsec.com/vuln/WPSEC-2026-2773/
- https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.8/
- https://wordpress.org/plugins/wp-booking-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS