CVE-2026-109369
Received Received - Intake

Authorization Bypass in WP Booking System WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page accessible) and allows them to harvest a valid wpbs_edit_form nonce that will pass validation against any other form_id.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-109369
EUVD
EUVD-2026-103226

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
murgroland WP Booking System – Booking Calendar 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Booking System – Booking Calendar plugin for WordPress has an authorization bypass vulnerability in versions up to 2.1.0.3. This flaw allows authenticated attackers with subscriber-level access or higher to grant themselves or others edit access to all booking forms by modifying the user_permission meta value that controls the plugin's access-control list. Exploitation requires the attacker to already have edit rights on at least one booking form.

Detection Guidance

To detect this vulnerability, check WordPress sites running the WP Booking System – Booking Calendar plugin versions up to 2.1.0.3. Look for unauthorized changes to user_permission meta values or unexpected edit access granted to users. Review server logs for suspicious activity related to booking form modifications or nonce usage.

Impact Analysis

An attacker could gain unauthorized edit access to all booking forms on your WordPress site. This could allow them to modify or delete bookings, steal sensitive data, or disrupt your booking system. The impact depends on the site's use of the plugin and the data stored in booking forms.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of personal or sensitive data stored in booking forms, potentially violating GDPR or HIPAA requirements for data protection and access control. Compliance may be compromised if unauthorized changes occur to protected health or personal information.

Mitigation Strategies

Update the WP Booking System – Booking Calendar plugin to the latest version beyond 2.1.0.3 to fix the authorization bypass issue. If an update is not available, consider disabling the plugin temporarily until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109369. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart