{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116557","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-10-26T14:45:35.039Z","datePublished":"2026-10-31T06:44:21.690Z","dateUpdated":"2026-10-31T06:44:21.690Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-10-31T06:44:21.690Z"},"affected":[{"vendor":"murgroland","product":"WP Booking System – Booking Calendar","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.1.0.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar."}],"title":"WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25cc768-3377-41c9-acf5-8f6c993287c9?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L123"},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L119"},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L111"},{"url":"https://plugins.trac.wordpress.org/changeset?old=3755940&old_path=%2Fwp-booking-system%2Ftrunk&new=3765778&new_path=%2Fwp-booking-system%2Ftrunk"},{"url":"https://plugins.trac.wordpress.org/changeset/3765778/wp-booking-system/trunk/includes/base/admin/calendar/functions-notes.php"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-862 Missing Authorization","cweId":"CWE-862","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL"}}],"credits":[{"lang":"en","type":"finder","value":"mamgad (mamgad)"}],"timeline":[{"time":"2026-10-26T15:04:54.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-10-30T18:25:33.000Z","lang":"en","value":"Disclosed"}]}}}