{"id":"CVE-2026-116557","title":"WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action","summary":"The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, …","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-862"],"vendor":"murgroland","product":"WP Booking System – Booking Calendar","affected":["wp_booking_system_booking_calendar <= 2.1.0.5"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-05T15:24:45.758498Z"},"published":"2026-10-31","updated":"2026-11-05","sourceUpdated":"2026-11-05T15:24:57.288Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116557","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25cc768-3377-41c9-acf5-8f6c993287c9?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L123"},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L119"},{"url":"https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L111"},{"url":"https://plugins.trac.wordpress.org/changeset?old=3755940&old_path=%2Fwp-booking-system%2Ftrunk&new=3765778&new_path=%2Fwp-booking-system%2Ftrunk"},{"url":"https://plugins.trac.wordpress.org/changeset/3765778/wp-booking-system/trunk/includes/base/admin/calendar/functions-notes.php"}],"tags":["cve.org"],"epss":0.00348,"epssPercentile":0.28557,"ingestedAt":"2026-11-05T21:36:00.897Z","slug":"CVE-2026-116557","body":"## Overview\n\nThe WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.\n\n## Affected\n\n- `wp_booking_system_booking_calendar <= 2.1.0.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}