CVE-2026-92619 wpdevelop CVE debrief

Who should care

WordPress site administrators, security teams, Editor-level users of the Booking Calendar plugin, and platform operators should assess exposure and apply patches as a high priority. This vulnerability allows authenticated attackers with Editor-level access to escalate privileges to Administrator, potentially leading to arbitrary core WordPress option manipulation and unauthorized Administrator account creation.

Why it matters

CVE-2026-92619 is a high-severity Privilege Escalation vulnerability in the Booking Calendar plugin for WordPress. Authenticated attackers with Editor-level access can exploit this vulnerability to escalate their privileges to Administrator, potentially leading to arbitrary core WordPress option manipulation and unauthorized Administrator account creation. WordPress site administrators and security teams should assess exposure and apply patches as a high priority.

• Privilege escalation for authenticated attackers with Editor-level access.
• Potential for arbitrary core WordPress option manipulation.
• Risk of unauthorized Administrator account creation.
• Need for verification of current plugin version and exposure.

Technical summary

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction.

Defensive priority

High priority for WordPress site administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Booking Calendar plugin version is 11.8.2 or earlier.
• Apply patches or updates provided by the vendor to fix the vulnerability.
• Monitor for suspicious activity related to the `wpbc_ajax_option_save` AJAX action.
• Restrict access to the WordPress admin interface for Editor-level users.
• Verify current plugin version and exposure.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in the `wpbc_ajax_option_save` AJAX action due to insufficient safeguards on option names. An attacker can write arbitrary core WordPress options, allowing privilege escalation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.