Booking Package CVE-2026-9851

Exploitation requires that the Booking Package plugin (version <= 1.7.16) is installed and active on a WordPress site, and that the attacker holds an authenticated session with Editor capability or higher (CVSS PR:H) so they can reach the package_app_action AJAX endpoint and obtain a valid nonce. No user interaction by the victim administrator is required (UI:N), and the attack works against default plugin configuration - no special plugin setting needs to be enabled. The principal limiting factor is the prerequisite Editor account; sites that never grant Editor (or Author/Contributor with elevated capabilities) to untrusted users meaningfully reduce exposure, while multi-author publishing sites, agencies, and membership sites that hand out Editor are at materially higher risk.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.2 (High), reflecting network reachability, low complexity, and full CIA impact, but requiring high privileges (Editor or above). This is realistic for WordPress sites that grant Editor accounts to contributors, freelancers, or content teams - a common configuration. There is no KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis'; however, the Wordfence advisory provides enough technical detail (file paths and line numbers) that exploit development is straightforward. EPSS is not provided in the input. The main signal divergence is the PR:H rating - in practice, Editor is a relatively low-trust role on many multi-author WordPress sites, so the real-world risk to such deployments is higher than the 7.2 score suggests, while single-admin blogs are largely unaffected.

An attacker who has obtained or been granted Editor-level credentials on a WordPress site running Booking Package logs in, retrieves a valid nonce from any admin page they can access, and issues a single authenticated POST to admin-ajax.php with action=package_app_action and the updateUser branch, supplying the administrator's user ID along with attacker-controlled email and password values. The plugin's dispatcher passes these values to wp_update_user() with the administrator flag forced on, immediately resetting the admin's credentials. The attacker then logs in as the administrator and uses full site control to install backdoors, exfiltrate data, or deface the site.