Privilege Escalation Vulnerability in Booking Calendar Plugin for WordPress

CVE-2026-92619

What is CVE-2026-92619?

The Booking Calendar plugin for WordPress contains a vulnerability that allows authenticated attackers with Editor-level access or higher to escalate their privileges to Administrator. This is achieved through the insecure handling of the wpbc_ajax_option_save AJAX action. The handle_ajax_save() function fails to restrict access correctly, enabling attackers to write core WordPress options directly to the database. By manipulating the data_name parameter, attackers can set options like default_role=administrator, effectively creating a new Administrator account for themselves. The nonce check is insufficient, as the parameters used can be easily manipulated by attackers, allowing for unauthorized changes to site roles and permissions.

References