CVE-2026-9851 is an authorization bypass vulnerability in the masaakitanaka Booking Package WordPress plugin. The flaw exists in the 'updateUser' branch of the 'package_app_action' AJAX endpoint, where the handler fails to perform a capability check and only validates a nonce. The dispatcher calls Schedule::updateUser() with the administrator argument hard-coded to 1, bypassing owner-restriction checks. This allows authenticated users with Editor-level privileges or higher to modify any user account by controlling the target user parameter passed directly to wp_update_user(), resulting in privilege escalation and potential full site takeover.

An attacker with Editor-level or higher privileges can escalate their privileges to Administrator by changing the email and password of any user account, including administrators. This leads to a full site compromise, allowing complete control over the affected WordPress site. The CVSS 3.1 base score is 7.2 (High), reflecting the network attack vector, low attack complexity, required privileges at a high level, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor-level access to trusted users only and consider disabling or removing the Booking Package plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.