CVE-2026-9851 is an authorization bypass vulnerability in the masaakitanaka Booking Package WordPress plugin (<=1.7.16). The issue arises from a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint. The handler validates only a nonce, and the dispatcher calls Schedule::updateUser() with the administrator argument hard-coded to 1, bypassing owner-restriction checks. This allows attackers with Editor-level privileges or higher to specify any target user via attacker-controlled input passed directly to wp_update_user(), enabling them to change credentials of any account, including administrators, resulting in full site compromise.

Authenticated users with Editor-level privileges or higher can escalate their privileges to administrator by changing the email address and password of any account. This leads to a complete site takeover, compromising confidentiality, integrity, and availability of the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor-level access to trusted users only and monitor for suspicious account changes. Avoid using the vulnerable versions (<=1.7.16) if possible.