CVE-2026-116557
Received Received - Intake

Unauthorized Data Modification in WP Booking System Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-116557
EUVD
EUVD-2026-114610

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
murgroland WP Booking System – Booking Calendar 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Booking System - Booking Calendar plugin for WordPress has a vulnerability in versions up to 2.1.0.5 where a missing capability check in the wpbs_action_ajax_calendar_remove_note() function allows unauthorized deletion of calendar notes. Authenticated attackers with Subscriber-level access or higher can exploit this to delete any calendar note.

Detection Guidance

To detect this vulnerability, check WordPress sites running the WP Booking System - Booking Calendar plugin versions up to 2.1.0.5. Look for unauthorized deletion of calendar notes by Subscriber-level users or higher. Inspect server logs for suspicious AJAX requests to wpbs_action_ajax_calendar_remove_note().

Impact Analysis

This vulnerability allows attackers to delete important calendar notes, potentially disrupting booking schedules, causing data loss, or manipulating records. If you use this plugin, unauthorized changes could affect your business operations or lead to incorrect information being displayed.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modification of data, which may violate integrity requirements in GDPR or HIPAA. If calendar notes contain sensitive information, their deletion could also affect data availability and accountability.

Mitigation Strategies

Update the WP Booking System - Booking Calendar plugin to the latest version, which should include a fix for the missing capability check. If an update is not available, consider disabling the plugin until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116557. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart