Booking Calendar CVE-2026-105195

Exploitation requires an authenticated WordPress account with the Editor role or higher on a site running Booking Calendar between version 10.15 and before 11.8.3; the attacker must reach one specific plugin settings handler that fails to restrict which options a lower-privileged user may load. There are no network-perimeter or configuration prerequisites beyond the plugin being installed and active, but the PR:H requirement is the key limiting factor - this cannot be triggered by anonymous or Subscriber/Author-level users, only by already-trusted high-privilege (non-admin) accounts, which sharply narrows the realistic attacker population to insiders or compromised Editor credentials.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base 2.7) correctly reflects a low-severity information disclosure: network-reachable and low-complexity, but gated behind high privileges (PR:H - an authenticated Editor-or-above account) with only limited confidentiality impact and no integrity or availability impact. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit is referenced - only a WPScan advisory entry. The realistic risk is that an already-trusted but non-admin user (Editor) can read WordPress options they should not see, which is primarily a privilege-boundary/lateral-information issue rather than an external compromise vector. The one caveat worth verifying with the vendor is impact scope: the description says 'arbitrary WordPress options, including core site configuration,' and because wp_options can hold secrets such as API keys, SMTP credentials, or third-party tokens, the real confidentiality impact could exceed the C:L rating depending on what a given site stores - but absent confirmation this is treated as C:L, not escalated.

A site operator grants a content contributor an Editor-role account; that user (or someone who phishes/compromises the Editor login) invokes the plugin's vulnerable settings handler to read option values across the entire WordPress installation, potentially harvesting core site configuration and any secrets stored in wp_options. No public proof-of-concept is referenced, and exploitation requires an existing authenticated Editor-or-higher session, so this is an insider/privilege-boundary scenario rather than opportunistic remote attack.