CVE-2026-105195: Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booking Calendar WordPress pluginto a version that resolves this vulnerability.Fixed in 11.8.3
Event History
Frequently Asked Questions
Which sites are exposed?
Sites using the WpDevArt Booking Calendar WordPress plugin in versions before 11.8.3 are affected. Exploitation requires an account with the Editor role or higher; unauthenticated and lower-privileged users are not identified as affected by the available data.
What access does an attacker need to exploit this issue?
The attacker must be able to authenticate as a WordPress user with the Editor role or a higher-privileged role. They can then use a plugin settings handler to load arbitrary WordPress option values.
What information could be exposed?
Affected users may disclose values from arbitrary WordPress options, including core site configuration. The available data does not specify which individual option values are accessible or whether any exposed values contain credentials.
What should be done if the plugin cannot be updated immediately?
The available data supports limiting access to Editor and higher-privileged accounts, since those roles are required for exploitation. Review those accounts and remove or restrict unneeded elevated access until the plugin can be updated to version 11.8.3 or later.