CVE-2026-105195
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Booking Calendar WordPress plugin before version 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
Risk Assessment
Disclosure of WordPress options could allow attackers to learn sensitive settings such as API keys, credentials, or configuration, potentially facilitating further attacks. The risk applies to installations with the Booking Calendar plugin.
Recommendation
Update the Booking Calendar plugin to version 11.8.3 or later, which includes a fix restricting access to options.
Other vulnerabilities in Booking Calendar
See all- CVE-2026-18496Medium
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 11.4.3. Unauthenticated attackers can extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.
- CVE-2026-105193Medium
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
- CVE-2026-39601Low
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.
- CVE-2026-93655Medium
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to and including 11.8.3 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute if they can trick a user into performing an action such as clicking a link.
- CVE-2026-92619High
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 11.8.2 via the wpbc_ajax_option_save AJAX action. An authenticated attacker with Editor-level access can write WordPress options such as default_role=administrator and create an administrator account.
- CVE-2026-92561Medium
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to and including 11.8.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled.
- CVE-2026-74002Medium
Unauthenticated Broken Access Control vulnerability in Booking Calendar plugin up to version 11.7. Unauthenticated users can access booking and management functions that should be restricted.
- CVE-2026-59558High
Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Booking Calendar plugin up to version 11.4.2. Allows an attacker to inject malicious scripts into the page.
- CVE-2025-64381Medium
The Booking Calendar plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Calendar versions from n/a through <= 10.14.7.
Original NVD description (English source)
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS