Summary
generated automatically from NVD dataThe WP Booking System - Booking Calendar plugin for WordPress has a missing authorization flaw (CWE-862) in the wpbs_action_ajax_calendar_remove_note() function, which performs no capability check. Through version 2.1.0.5, any authenticated user with Subscriber-level access or higher can delete arbitrary calendar notes belonging to any calendar, causing unauthorized data modification. The CVSS v3.1 score is 9.1 (CRITICAL).
NVD description
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.
EPSS · FIRST.org
0.35%probability of exploitation in the next 30 days
Higher than 28% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-31, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 31 oct. 2026
- Updated
- 31 oct. 2026
- Status
- Received
- Source
- security@wordfence.com
Weaknesses (CWE)
References (6)
Similar CVEs
Other vulnerabilities of type CWE-862
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.