CVE-2026-91025: Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with Subscriber-level access or higher can exploit it. The attacker does not need administrator privileges, but they do need a valid account.
Which users can be targeted?
An attacker can create or overwrite Booking Manager-specific per-user settings for arbitrary accounts, including administrator accounts. The issue is caused by missing verification that the requested target account belongs to the requesting user.
Are unauthenticated visitors affected?
No. The available information states that exploitation requires an authenticated WordPress user account with at least Subscriber-level access.
How can I determine whether my site is affected?
Sites using a Booking Manager version earlier than 2.1.21 are affected. Review whether untrusted or low-privileged users, such as subscribers, have accounts on the site.