WP Booking System CVE-2026-109369

Exploitation requires an authenticated account (PR:L) that has ALREADY been delegated edit rights on at least one booking form by an administrator - this is the pivotal precondition, not merely subscriber access. That delegation does two things the attack depends on: it downgrades the plugin submenu capability to 'read' so the edit page becomes reachable, and it exposes a valid wpbs_edit_form nonce that the plugin fails to scope per form_id, so it validates against any other form. The limiting factors that reduce real-world risk: the attacker cannot be a random unauthenticated visitor or even an arbitrary subscriber - an admin must have granted them per-form edit delegation first; impact is confined to the plugin's own booking-form ACL and data (no host/site-wide takeover is described); and no user interaction by a victim is needed (UI:N). Affects all versions up to and including 2.1.0.3.

This is a medium-severity authorization bypass (CVSS 6.8, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) whose real-world urgency is lower than the CVSS base would suggest once the preconditions are weighed. The network vector (AV:N) and high confidentiality/integrity impact (C:H/I:H) are offset by two restraining metrics that the description reinforces: AC:H and PR:L. Exploitation status is 'no public exploit identified at time of analysis' - no KEV listing and no POC flag were provided, and no EPSS score was supplied, so there is no signal of active or probable exploitation. The SSVC-style read is favorable to defenders: exploitation is not observed, technical impact is partial-to-total within the plugin's own ACL, and automatability is low because the attacker must first have been manually delegated edit rights on a booking form by an administrator. The most important nuance is that although the CVE is network-reachable and 'subscriber-level and above' is cited, the actual precondition is stronger than a bare subscriber account - the attacker must already hold delegated edit rights on at least one form, which both exposes the edit page and yields a reusable wpbs_edit_form nonce. This makes it a privilege-escalation-within-trusted-delegates issue rather than a drive-by unauthenticated takeover, so it warrants patching on a normal cadence rather than emergency response.

An administrator delegates edit access on a single booking form to a low-privileged user (e.g. a staff member with a subscriber account). That user visits the now-accessible edit page, harvests the valid wpbs_edit_form nonce, and replays it against other form_ids to overwrite the user_permission meta ACL, granting themselves and arbitrary other accounts edit access to every booking form on the site. No public exploit code was identified at time of analysis, and the high attack complexity reflects the required prior delegation.