Bookit Booking Calendar CVE-2026-89007

Exploitation requires an authenticated account holding the Bookit plugin's custom low-privileged 'Staff' role on a site running Bookit - Booking & Appointment Calendar before 2.6.0.5; the attacker then calls the appointment-deletion function that omits its capability check. Limiting factors: the attacker must already possess a Staff-role account (not a default WordPress role, so it must be provisioned by an admin), impact is confined to deleting appointment records with no read or availability impact beyond lost bookings, and no user interaction is needed. This makes it primarily an insider/multi-staff-deployment risk rather than an internet-wide unauthenticated threat.

This is a genuinely low-priority issue despite the publicly available PoC. The vendor CVSS of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) captures a narrow flaw: an authenticated user holding the plugin's custom 'Staff' role can delete arbitrary appointments due to a missing capability check in one deletion function (CWE-862). No confidentiality or availability impact is claimed, only limited integrity (destruction of appointment records). Note a metric tension: the vendor scores PR:H, but the description itself calls the Staff role 'low-privileged,' which more naturally maps to PR:L - that would raise the score to roughly 4.3, still low. No EPSS score is provided and the CVE is not in CISA KEV, so there is no signal of widespread or automated exploitation; a WPScan-published PoC exists but PoC availability is not active exploitation. The main mitigating factor is the authentication requirement - an attacker must already hold a plugin-assigned Staff account, so this is far more relevant to insider/multi-staff deployments than to internet-wide opportunistic attack.

A malicious or compromised user who has been granted the plugin's low-privileged Staff role sends a crafted request to the unprotected appointment-deletion function and removes appointments they should not be able to touch. Because the function omits the capability check, deletions succeed for any appointment ID. A public PoC is available via WPScan, lowering the bar to reproduce.