CVE-2026-109369 murgroland CVE debrief

Who should care

Site administrators and defenders who use the WP Booking System – Booking Calendar plugin for WordPress should assess their exposure and prioritize verification and remediation. This vulnerability allows authenticated attackers with subscriber-level access and above to grant themselves and arbitrary other users edit access to every booking form on the site. Therefore, site administrators, defenders, and security teams responsible for managing WordPress

Why it matters

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass, allowing authenticated attackers to grant themselves and others edit access to booking forms.

• Authenticated attackers with subscriber-level access and above can grant themselves and arbitrary other users edit access to every booking form on the site.
• The vulnerability allows for overwriting of the user_permission meta that governs the plugin's own access-control list.

Technical summary

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves and arbitrary other users edit access to every booking form on the site by overwriting the user_permission meta that governs the plugin's own access-control list. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (making the edit page

Defensive priority

Defenders should prioritize verifying the version of the WP Booking System – Booking Calendar plugin and ensuring that it is updated to a version that is not vulnerable.

Recommended defensive actions

• Verify the version of the WP Booking System – Booking Calendar plugin and update to a non-vulnerable version.
• Monitor for suspicious activity on the site, particularly related to booking forms.
• Restrict access to the plugin's settings and booking forms to authorized users only.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source references provide details on the vulnerability, including the affected plugin and versions. The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. Exploitation requires the attacker to have already been delegated edit rights on at least one booking form, as this delegation both downgrades the submenu capability to 'read' (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.