CVE-2026-105195: Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure

Q: Which sites are exposed?

Sites using the WpDevArt Booking Calendar WordPress plugin in versions before 11.8.3 are affected. Exploitation requires an account with the Editor role or higher; unauthenticated and lower-privileged users are not identified as affected by the available data.

Q: What access does an attacker need to exploit this issue?

The attacker must be able to authenticate as a WordPress user with the Editor role or a higher-privileged role. They can then use a plugin settings handler to load arbitrary WordPress option values.

Q: What information could be exposed?

Affected users may disclose values from arbitrary WordPress options, including core site configuration. The available data does not specify which individual option values are accessible or whether any exposed values contain credentials.

Q: What should be done if the plugin cannot be updated immediately?

The available data supports limiting access to Editor and higher-privileged accounts, since those roles are required for exploitation. Review those accounts and remove or restrict unneeded elevated access until the plugin can be updated to version 11.8.3 or later.

Published Oct 8, 2026

Updated

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.

Affected Software

1 affected component

WpDevArt Booking Calendar>=10.15<=11.8.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Booking Calendar WordPress plugin to a version that resolves this vulnerability.
Fixed in 11.8.3

Event History

Oct 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which sites are exposed?

Sites using the WpDevArt Booking Calendar WordPress plugin in versions before 11.8.3 are affected. Exploitation requires an account with the Editor role or higher; unauthenticated and lower-privileged users are not identified as affected by the available data.

What access does an attacker need to exploit this issue?

The attacker must be able to authenticate as a WordPress user with the Editor role or a higher-privileged role. They can then use a plugin settings handler to load arbitrary WordPress option values.

What information could be exposed?

Affected users may disclose values from arbitrary WordPress options, including core site configuration. The available data does not specify which individual option values are accessible or whether any exposed values contain credentials.

What should be done if the plugin cannot be updated immediately?

The available data supports limiting access to Editor and higher-privileged accounts, since those roles are required for exploitation. Review those accounts and remove or restrict unneeded elevated access until the plugin can be updated to version 11.8.3 or later.

CVE-2026-105195: Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed?

What access does an attacker need to exploit this issue?

What information could be exposed?

What should be done if the plugin cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed?

What access does an attacker need to exploit this issue?

What information could be exposed?

What should be done if the plugin cannot be updated immediately?