# WP Booking System – Booking Calendar <= 2.1.0.7 - Authenticated (Calendar-Assigned User+) Missing Authorization to Legend Item Deletion

- **ID:** WPSEC-2026-2773
- **Plugin:** WP Booking System – Booking Calendar (`wp-booking-system`), https://wordpress.org/plugins/wp-booking-system/
- **Affected versions:** from 2.1 before 2.1.0.8
- **Fixed in:** 2.1.0.8 (Update to 2.1.0.8 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-booking-system
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2773/

## Description

The WP Booking System plugin for WordPress is vulnerable to unauthorized modification of data via the 'delete_legend_item' admin action in all versions up to, and including, 2.1.0.7, due to a missing calendar access check in the wpbs_action_delete_legend_item function, which verifies only a nonce that is not tied to a specific calendar before deleting the legend item identified by the legend_item_id parameter. This makes it possible for authenticated attackers who have been granted access to at least one calendar to delete legend items belonging to calendars they are not permitted to manage.

## References

- https://wpsec.com/vuln/WPSEC-2026-2773/
- https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.8/
- https://wordpress.org/plugins/wp-booking-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2773/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.