Zero Radar
← feed
CriticalVulnerabilityCVE-2026-116557updated 31 Oct 2026, 11:29 UTC

WP Booking System plugin lets low-level users delete calendar notes

A WordPress booking plugin lets any logged-in user, even a basic subscriber, delete booking calendar notes that belong to others. Someone could remove important notes without permission.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Subscriber logs inAny authenticated account with basic access
  2. 2Calls remove-note actionAJAX request to wpbs_action_ajax_calendar_remove_note
  3. 3No capability checkPlugin skips verifying the user's permissions
  4. 4Calendar note deletedNotes from any calendar can be removed
  5. ResultBooking calendar notes are deleted by unauthorized users

What happened

The wpbs_action_ajax_calendar_remove_note() function in WP Booking System - Booking Calendar lacks a capability check, enabling authenticated Subscriber-level users to delete arbitrary calendar notes across any calendar.

Why it is dangerous: Calendar notes can be deleted by low-privilege accounts, causing data loss or disruption to booking management for site owners and staff.

Are you affected?

You are affected if you run WP Booking System - Booking Calendar version 2.1.0.5 or earlier on WordPress and allow user accounts such as Subscriber.

WP Booking System - Booking Calendar (WordPress plugin) up to and including 2.1.0.5

What to do

  1. Check your installed WP Booking System version and confirm whether it is 2.1.0.5 or earlier.
  2. Restrict or review user registrations, removing unnecessary Subscriber accounts where possible.
  3. Watch the plugin's official WordPress page or GitHub advisory for a fixed release and update when available.

Timeline

  1. 31 Oct 2026, 07:16 UTC
    Publicly disclosed
  2. 31 Oct 2026, 07:16 UTC
    Reported by NVD · NVD
  3. 31 Oct 2026, 07:18 UTC
    Picked up by Zero Radar
  4. 31 Oct 2026, 11:29 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116557 · GHSA-wwrg-9g45-mxcv
CVSS
9.1 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
31 Oct 2026, 07:16 UTC
On Zero Radar
31 Oct 2026, 07:18 UTC (2 min after disclosure)
Last change
31 Oct 2026, 11:29 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WP Booking System plugin lets low-level users delete calendar notes · Zero Radar