CVE-2026-9851
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in the Booking Package plugin for WordPress up to version 1.7.16 allows privilege escalation via account takeover. Missing capability checks in the package_app_action AJAX endpoint let authenticated attackers with Editor-level access or above change the email and password of any account, including administrators.
Risk Assessment
An attacker can gain full control of the WordPress site by changing the administrator's login credentials.
Recommendation
Update the Booking Package plugin to version 1.7.17 or later, which includes the fix.
Other vulnerabilities in Booking Package
See all- CVE-2026-16986Medium
The Booking Package WordPress plugin before version 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price.
- CVE-2026-15335High
The Booking Package plugin for WordPress up to version 1.7.20 is vulnerable to generic SQL injection via the 'email' form parameter (form<N>). Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive database information.
- CVE-2026-40774High
The Booking package versions <= 1.7.06 have an issue with unauthenticated access that allows for broken access control.
Original NVD description (English source)
The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.