CVE-2026-116557 WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
CriticalCVSS 9.1
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| murgroland WP Booking System – Booking Calendar | <= 2.1.0.5 | No fix listed |
| wordpress wp-booking-system(WordPress) | < 2.1.0.6 | 2.1.0.6 |