CVE-2026-92619: Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the wpbcajaxoptionsave AJAX action. The vulnerability exists because the handleajaxsave() function applies per-option safeguards only to names explicitly registered via registeroptionpolicy(), causing getoptionpolicy() to return an empty policy — bypassing all cansave, forcemode, and allowedkeys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled dataname parameter passes through sanitizekey() and is written directly to updateoption() without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as defaultrole=administrator and userscanregister=1, then self-registering a new Administrator account. The nonce check does not meaningfully restrict this attack, as both the nonce value and nonce action are attacker-supplied POST parameters, and a valid nonce is trivially obtainable via admin-ajax.php?action=rest-nonce.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Booking Calendar pluginto a version that resolves this vulnerability.Fixed in 11.8.2 - Configuration
Modify the Booking Calendar plugin so handle_ajax_save() does not allow write access when get_option_policy() returns an empty policy. Enforce can_save/force_mode/allowed_keys (or reject the request) for any data_name not explicitly registered via register_option_policy().
WordPress Booking Calendar plugin (AJAX save handling) register_option_policy() / get_option_policy() enforcement for wpbc_ajax_option_save = Ensure an option policy exists for any data_name passed to handle_ajax_save (deny/whitelist otherwise); apply can_save/force_mode/allowed_keys checks to unregistered options instead of allowing get_option_policy() to return empty. - Compensating control
Restrict access to WordPress admin-ajax.php endpoint used by the Booking Calendar plugin (e.g., block/limit unauthenticated access and restrict editor-level accounts) using firewall/WAF/ACL as an interim mitigation while the plugin is fixed.
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An authenticated WordPress user with the Editor role or a higher role can exploit it. No user interaction is required, and the attack is reachable over the network through the plugin's AJAX action.
Does the nonce protection prevent exploitation?
No. Both the nonce value and nonce action are supplied by the attacker, and a valid nonce can be obtained through admin-ajax.php?action=rest-nonce.
What can an attacker change to become an administrator?
The attacker can write unregistered WordPress option names through the data_name parameter. One described path is setting default_role to administrator and users_can_register to 1, then registering a new Administrator account.
Are only Booking Calendar settings affected?
No. The missing policy for unregistered option names bypasses the plugin's option-level safeguards, allowing writes to core WordPress options as well as options not registered with the plugin's policy mechanism.