CVE-2026-91025
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's plugin-specific settings targets the requesting user's own account. Any authenticated user with subscriber-level access and above can create or overwrite the plugin's per-user settings on arbitrary users, including administrators.
Risk Assessment
An attacker can modify the configuration of other accounts, including administrators, potentially leading to privilege escalation or disruption of the booking system. The issue affects even the lowest-privileged users.
Recommendation
Update the Booking Manager plugin to version 2.1.21 or later. Verify that user settings have not been unauthorizedly changed.
Other vulnerabilities in Booking Manager
See all- CVE-2026-91024Medium
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query. Authenticated users with Author-level access and above can perform SQL injection attacks by importing a feed they control.
- CVE-2025-64275Medium
The Booking Manager plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Manager versions from n/a through <= 2.1.17.
Original NVD description (English source)
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS