CVE-2026-109369: CWE-862 Missing Authorization in murgroland WP Booking System – Booking Calendar

CVE-2026-109369 is an authorization bypass vulnerability (CWE-862) in the WP Booking System – Booking Calendar plugin for WordPress, affecting all versions up to and including 2.1.0.3. The plugin fails to properly verify user authorization when performing certain actions, allowing authenticated users with subscriber-level privileges or higher to escalate their permissions. Specifically, attackers who already have edit rights on at least one booking form can use a valid wpbs_edit_form nonce to overwrite the user_permission meta, thereby granting themselves and arbitrary users edit access to every booking form on the site. This occurs because the submenu capability is downgraded to 'read', making the edit page accessible and enabling nonce harvesting that passes validation for other form IDs.

Successful exploitation allows authenticated low-privilege users to escalate their permissions to edit all booking forms managed by the plugin. This can lead to unauthorized modification of booking data and potentially compromise the integrity of the booking system. The vulnerability does not affect availability but impacts confidentiality and integrity with a CVSS v3.1 base score of 6.8 (medium severity). No known exploits are reported in the wild.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict user roles to trusted individuals and avoid delegating edit rights on booking forms to low-privilege users. Review and limit subscriber-level user capabilities where possible to reduce risk.