{
 "id": "WPSEC-2026-2773",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2773/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2773/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2773/index.md",
 "title": "WP Booking System – Booking Calendar <= 2.1.0.7 - Authenticated (Calendar-Assigned User+) Missing Authorization to Legend Item Deletion",
 "description": "The WP Booking System plugin for WordPress is vulnerable to unauthorized modification of data via the 'delete_legend_item' admin action in all versions up to, and including, 2.1.0.7, due to a missing calendar access check in the wpbs_action_delete_legend_item function, which verifies only a nonce that is not tied to a specific calendar before deleting the legend item identified by the legend_item_id parameter. This makes it possible for authenticated attackers who have been granted access to at least one calendar to delete legend items belonging to calendars they are not permitted to manage.",
 "plugin": {
  "slug": "wp-booking-system",
  "name": "WP Booking System – Booking Calendar",
  "full_name": "WP Booking System – Booking Calendar",
  "wordpress_org": "https://wordpress.org/plugins/wp-booking-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-booking-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-booking-system"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.1",
    "from_inclusive": true,
    "to": "2.1.0.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.1 before 2.1.0.8"
  ]
 },
 "introduced_in": "2.1",
 "fixed_in": "2.1.0.8",
 "remediation": "Update to 2.1.0.8 or later.",
 "fix_released": "2026-11-09T07:33:59+00:00",
 "published": "2026-11-10T07:51:46+00:00",
 "updated": "2026-11-09T23:34:11.135300+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2773/",
  "https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.8/",
  "https://wordpress.org/plugins/wp-booking-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-booking-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-10"
 }
}