Booking Calendar CVE-2026-92619

Requires an authenticated WordPress account with Editor-level capabilities or higher on a site running the Booking Calendar (wpdevelop) plugin version <=11.8.2; no non-default plugin configuration is needed because the wpbc_ajax_option_save handler accepts any unregistered option name and writes it via update_option() unrestricted. The completing step (self-registering the Administrator account) requires the attacker to first set users_can_register=1 themselves, which the same flaw permits, so open registration is NOT a precondition. Limiting factors: attacker must already hold a trusted Editor+ role (PR:L/PR:H), so this is not exploitable by anonymous visitors; no user interaction is required and the nonce check provides no real barrier.

This is a genuinely high-priority privilege-escalation flaw despite modest signals on the exploitation-maturity axis. The vendor CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full compromise (C:H/I:H/A:H) from a network-reachable, low-complexity attack; the only meaningful barrier is the required authenticated Editor-or-above account. I assess PR as more accurately PR:L than the vendor's PR:H - an Editor is a trusted-but-non-administrative role, and Wordfence's own writeup frames it as an escalation from Editor, which under CVSS 3.1 typically maps to PR:L (raising the real score toward ~8.8). No EPSS score, CISA KEV entry, or public POC were supplied in the input, so exploitation is: no public exploit identified at time of analysis. The attack is technically trivial once an Editor account exists - the described nonce 'protection' is a no-op because both nonce value and action are attacker-supplied and any nonce is fetchable via admin-ajax.php?action=rest-nonce - so the primary limiting factor is credential/role access, not attack difficulty. No conflicting signals between vector and description: both agree this is network, low-complexity, authenticated, full-impact. Treat as a real priority for any site with untrusted Editor-level users.

An attacker who controls or compromises a WordPress Editor account on a site running Booking Calendar <=11.8.2 fetches a valid nonce from admin-ajax.php?action=rest-nonce, then POSTs to the wpbc_ajax_option_save action with data_name=default_role and value=administrator, and again to set users_can_register=1. They then visit the public registration page to self-register a brand-new Administrator account, achieving full site takeover. No public exploit code is identified in the provided data, but the technique is fully described and trivial to reproduce.