WP Booking System: Missing authorization allows deletion of calendar notes

Summary

The WP Booking System - Booking Calendar WordPress plugin up to and including version 2.1.0.5 lacks a capability check in the wpbs_action_ajax_calendar_remove_note() function. An authenticated user with at least Subscriber rights can delete arbitrary calendar notes of any calendar, which mainly disrupts bookings and removes internal notes. The published CVSS vector lists no privileges required, which conflicts with the Subscriber requirement, so the score may be re-rated.

Affected

• WP Booking System (WordPress plugin) versions up to and including 2.1.0.5
• Unaffected by default configuration is not stated in the sources; check the installed version.

Fixed in

• Version 2.1.0.6 is likely to contain the fix. This is not confirmed against changeset r3765778.
• Verify that the installed version is 2.1.0.6 or later.

Workaround

• No workaround found in the sources. Update the plugin.
• Until the update is applied, restrict account registration and review calendar notes for unexpected deletions.

Exploitation

• No exploitation in the wild known at the time of writing.
• No public exploit code known as of the 30 Oct 2026 snapshot.

Our recommendation

• Inventory WordPress sites that use the plugin and record the installed version.
• Update to 2.1.0.6 or later and verify the version.
• Disable open subscriber registration if business needs allow it.
• Back up calendar data and audit recent note deletions.
• Monitor the NVD and Wordfence entries for the final CVSS score and fixed version.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Wordfence threat intelligence entry www.wordfence.com
• Vulnerable code in version 2.1.0.5 plugins.trac.wordpress.org
• Trunk changeset 3765778 plugins.trac.wordpress.org
• WordPress.org plugin page and changelog wordpress.org
• Vendor changelog wpbookingcalendar.com
• OffSeq threat radar entry radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:22.