What is the CVSS score of CVE-2026-9851?

CVE-2026-9851 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Booking Package are affected by CVE-2026-9851?

The Booking Package WordPress plugin (versions ≤1.7.16) exposes WordPress sites to account takeover attacks when users with Editor-level permissions are compromised.

How to fix or mitigate CVE-2026-9851?

Within 24 hours: Confirm if Booking Package plugin is installed and document all users with Editor-level or above permissions. Within 7 days: Either deactivate and remove the plugin, or implement strict access controls limiting Editor-level permissions to essential administrators only. Within 30 days: Monitor vendor advisories for a security patch; when released, update to the patched version (post-1.7.16).

Booking Package CVE-2026-9851

EUVD-2026-34961 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-06 Wordfence

GHSA-9gp9-g392-77v9

WordPress Authentication Bypass Privilege Escalation Wordpress Plugin Booking Package Masaakitanaka

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:20 vuln.today

CVE Published

Jun 06, 2026 - 04:28 nvd

HIGH 7.2

DescriptionCVE.org

The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.

AnalysisAI

Privilege escalation in the Booking Package plugin for WordPress (versions up to and including 1.7.16) allows authenticated attackers with Editor-level access or above to take over any account, including Administrator accounts, by abusing the 'updateUser' branch of the package_app_action AJAX endpoint. The handler validates only a nonce and passes a hard-coded administrator flag to Schedule::updateUser(), letting attackers supply arbitrary target user IDs to wp_update_user() and reset the email and password of any account. No public exploit identified at time of analysis, but the issue was disclosed by Wordfence and results in full site compromise once an Editor account is obtained.

Technical ContextAI

The vulnerability resides in the masaakitanaka 'booking-package' WordPress plugin (CPE cpe:2.3:a:masaakitanaka:booking_package:*) within its AJAX dispatcher in index.php (around lines 4416 and 4477) and the Schedule::updateUser() function in lib/Schedule.php (around line 868). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key) - the dispatcher invokes Schedule::updateUser() with the $administrator parameter hard-coded to 1, which short-circuits the owner-restriction check inside the function. Because the target user identifier is taken directly from attacker-supplied request input and passed to WordPress's wp_update_user() API, there is no enforcement that the caller may only edit their own profile, allowing arbitrary user mutation.

RemediationAI

Upstream fix available (changeset 3558752 on plugins.trac.wordpress.org); a released patched version is not independently confirmed beyond 'after 1.7.16' - administrators should update the Booking Package plugin to the latest available version from the WordPress.org repository and verify the installed version is greater than 1.7.16. Until the update is applied, compensating controls include temporarily deactivating the Booking Package plugin (loses booking functionality), tightening Editor role assignments and auditing existing Editor accounts for unexpected users, restricting access to /wp-admin/admin-ajax.php?action=package_app_action via a WAF rule or web server ACL (may break legitimate booking workflows), and forcing password resets plus reviewing recent administrator email changes. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/795c1fd6-137b-4414-8d6b-30053bfb5924 for indicators and detection guidance.