CVE-2026-92619 wpdevelop CVE debrief

Who should care

WordPress site administrators, security teams, and users with Editor-level access or above should assess exposure and apply patches as a high priority. Additionally, users with administrative access to WordPress sites using the Booking Calendar plugin should review the vulnerability details and take immediate action to prevent exploitation.

Why it matters

CVE-2026-92619 is a high-severity Privilege Escalation vulnerability in the Booking Calendar plugin for WordPress. Authenticated attackers with Editor-level access can escalate privileges to Administrator, potentially leading to unauthorized changes and site compromise. WordPress site administrators and security teams should assess exposure and apply patches as a high priority.

• Privilege escalation from Editor to Administrator
• Potential for unauthorized changes to core WordPress options
• Risk of self-registration as an Administrator account
• Possible disruption to site management and security

Technical summary

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2. The vulnerability exists in the `wpbc_ajax_option_save` AJAX action. An attacker with Editor-level access can escalate privileges to Administrator by manipulating core WordPress options. The `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and

Defensive priority

High priority for WordPress site administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Booking Calendar plugin version is 11.8.2 or earlier.
• Apply patches or updates to the Booking Calendar plugin to prevent exploitation.
• Monitor for suspicious activity, especially changes to core WordPress options.
• Restrict Editor-level access and above to trusted users only.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in the `wpbc_ajax_option_save` AJAX action due to insufficient safeguards on option names. An attacker can escalate privileges by writing core WordPress options, such as setting the default role to 'administrator' and enabling user registration, then self-registering as an Administrator.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.