Vulnerability record/PUBLISHED/Published Oct 31, 2026 06:44:21 UTC
CVE-2026-116557
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.
Base score9.1/ 10
SeverityCriticalCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWordfence
Last updatedOct 31, 2026 06:44:21 UTC
PublishedOct 31, 2026 06:44:21 UTC
ReservedOct 26, 2026 14:45:35 UTC
Credits
- mamgad (mamgad)