Authorization Bypass Vulnerability in WP Booking System Plugin for WordPress

CVE-2026-109369

What is CVE-2026-109369?

The WP Booking System plugin for WordPress contains a significant vulnerability that allows authenticated users with subscriber-level access and above to bypass authorization controls. This flaw arises from inadequate verification of user permissions, enabling attackers to overwrite the user_permission meta. As a result, they can grant themselves and others unauthorized edit access to all booking forms on the site. Exploitation of this vulnerability necessitates prior edit rights on at least one booking form, which allows for the downgrading of submenu capabilities to 'read' and enables the attacker to obtain a valid nonce. It's essential for users of this plugin to apply necessary updates to mitigate potential risks.

References