CVE-2026-92619
HighCVSS 7.2Summary
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 11.8.2 via the wpbc_ajax_option_save AJAX action. An authenticated attacker with Editor-level access can write WordPress options such as default_role=administrator and create an administrator account.
Risk Assessment
An attacker with Editor privileges can take full control of the WordPress site by creating their own administrator account, leading to complete site compromise.
Recommendation
Update the Booking Calendar plugin to a version later than 11.8.2 or disable it until a fix is deployed.
Other vulnerabilities in Booking Calendar
See all- CVE-2026-92561Medium
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to and including 11.8.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled.
- CVE-2026-74002Medium
Unauthenticated Broken Access Control vulnerability in Booking Calendar plugin up to version 11.7. Unauthenticated users can access booking and management functions that should be restricted.
- CVE-2026-59558High
Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Booking Calendar plugin up to version 11.4.2. Allows an attacker to inject malicious scripts into the page.
Original NVD description (English source)
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as `default_role=administrator` and `users_can_register=1`, then self-registering a new Administrator account. The nonce check does not meaningfully restrict this attack, as both the nonce value and nonce action are attacker-supplied POST parameters, and a valid nonce is trivially obtainable via `admin-ajax.php?action=rest-nonce`.