CVE-2026-109147 WP Booking System CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP Booking System plugin, especially those with high-privilege users, should assess exposure and prioritize mitigation. This includes operators managing WordPress environments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and mitigating potential threats.

Why it matters

The WP Booking System plugin for WordPress has a Reflected Cross-Site Scripting (XSS) vulnerability that could be exploited against high-privilege users, potentially leading to unauthorized actions or data exposure. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where high-privilege users are likely to interact with the affected plugin.

• Potential for unauthorized actions by high-privilege users
• Possible data exposure through reflected XSS
• Need for prompt patching or mitigation to prevent exploitation
• Verification of plugin version and user interaction required

Technical summary

The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators. This vulnerability occurs because the plugin does not properly validate and escape the 'booking_id' parameter before reflecting it back in an admin page. An attacker could exploit this vulnerability against high-privilege users, potentially leading to unauthorized actions or data exposure.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where high-privilege users are likely to interact with the affected plugin.

Recommended defensive actions

• Patch or upgrade WP Booking System to version 2.1.0.3 or later
• Implement additional security measures for high-privilege user accounts
• Monitor for suspicious activity related to the WP Booking System plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability but do not offer specific information on exploitation or affected versions beyond the plugin version 2.1.0.3. The NVD entry is currently empty.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.