CVE-2026-116557: WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

Q: What level of access does an attacker need?

The detailed vulnerability information states that an attacker needs an authenticated WordPress account with Subscriber-level access or higher. Although the title refers to unauthenticated deletion, the description specifies authenticated attackers.

Q: Which installations should be considered affected?

WP Booking System versions up to and including 2.1.0.5 are identified as affected.

Q: What data can an attacker modify?

An eligible low-privileged attacker can delete arbitrary calendar notes, including notes belonging to any calendar rather than only calendars they own.

Published Oct 31, 2026

Updated

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The detailed vulnerability information states that an attacker needs an authenticated WordPress account with Subscriber-level access or higher. Although the title refers to unauthenticated deletion, the description specifies authenticated attackers.

Which installations should be considered affected?

WP Booking System versions up to and including 2.1.0.5 are identified as affected.

What data can an attacker modify?

An eligible low-privileged attacker can delete arbitrary calendar notes, including notes belonging to any calendar rather than only calendars they own.

CVE-2026-116557: WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

Event History

Frequently Asked Questions

What level of access does an attacker need?

Which installations should be considered affected?

What data can an attacker modify?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Which installations should be considered affected?

What data can an attacker modify?