Booking Manager CVE-2026-91025

Requires the Booking Manager WordPress plugin (version before 2.1.21) installed and active, and an attacker holding any authenticated account at subscriber level or above (PR:L) - open user registration makes this trivial to obtain. The vulnerable settings-update handler does not verify that the target account equals the requesting user, so the attacker supplies an arbitrary user ID. No user interaction (UI:N) and no non-default configuration are required beyond having the plugin active; the limiting factors are the need for a valid low-privilege session and that impact is confined to overwriting per-user plugin settings (integrity-only, I:L).

This is a low-to-moderate priority authorization flaw, not a high-urgency issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) is internally consistent with the description: network-reachable, low complexity, but requiring low-privilege authentication (any subscriber-level+ account) and yielding only limited integrity impact (C:N/I:L/A:N) - the attacker can create or overwrite another user's plugin-specific per-user settings but gains no confidentiality or availability impact and no direct privilege escalation from the CVSS scoring. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active exploitation or ready-made exploit code. The main aggravating factor is that targets can include administrators, so depending on what those per-user settings control, an attacker could theoretically tamper with an admin's plugin behavior; however, the CVE data caps impact at I:L, so this remains a targeted, authenticated integrity-tampering issue rather than a mass-exploitation candidate. Note the 'Authentication Bypass' tag conflicts with the actual weakness (CWE-639, an authorization/IDOR flaw, not an authentication bypass) - the flaw does NOT bypass login, it requires a valid low-privilege account.

An attacker registers or obtains any subscriber-level account on a WordPress site running Booking Manager before 2.1.21, then sends a settings-modification request specifying another user's ID - including an administrator - to create or overwrite that user's plugin-specific per-user settings. No public exploit code is identified at time of analysis, and exploitation requires only a low-privilege authenticated session (PR:L, AC:L, no user interaction).