WP Booking System CVE-2026-116557

Requires a WordPress site running WP Booking System - Booking Calendar version ≤ 2.1.0.5 and an attacker account at Subscriber level or above; the wpbs_action_ajax_calendar_remove_note() function omits a capability check, so any such authenticated user can invoke the AJAX action to delete notes belonging to any calendar. Key limiting factor: an authenticated low-privilege account is needed per the description (PR:L), so sites that disable open user registration meaningfully reduce exposure - note this contradicts the supplied CVSS PR:N. Impact is bounded to deletion of calendar notes; no confidentiality exposure and no code execution result.

The headline signal is a CVSS 3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and a vuln.today 'act_now' decision label, which together imply an urgent, remotely exploitable flaw. However, there is a material conflict between the supplied CVSS vector and the description: the vector states PR:N (unauthenticated), while the description explicitly requires 'Subscriber-level access and above' - an authenticated prerequisite that corresponds to PR:L. This discrepancy should be verified with Wordfence/NVD, because it changes real-world risk substantially: unauthenticated mass exploitation versus exploitation only by registered low-privilege users. No EPSS score, no CISA KEV listing, and no working exploit code are present in the input, so there is no evidence of active or automated exploitation at this time; the 'act_now' label appears driven by the high CVSS and the trivial attack complexity rather than observed exploitation. The underlying weakness is a classic CWE-862 missing authorization (broken access control), and the real impact is bounded - an attacker can delete arbitrary calendar notes but gains no confidentiality access and no code execution or site takeover. Net: a genuine access-control defect worth patching promptly given the 'act_now' signal and low exploitation barrier, but the raw 9.1 likely overstates it if the true privilege requirement is Subscriber (PR:L) and the impact is limited to note deletion.

An attacker registers (or already holds) a Subscriber-level account on a WordPress site running WP Booking System ≤ 2.1.0.5 and sends a crafted AJAX request to the wpbs_action_ajax_calendar_remove_note() action, which performs no capability check. The request deletes calendar notes belonging to any calendar on the site, enabling destruction of booking-related annotations across all calendars. No public working exploit code is identified in the available data, though the vulnerable code and its fix are publicly visible on WordPress.org trac.