Threats tagged 'ghsa-wwrg-9g45-mxcv'

The WP Booking System - Booking Calendar plugin for WordPress versions up to and including 2.1.0.5 contains a vulnerability that allows authenticated users with Subscriber-level access or higher to delete arbitrary calendar notes. This is due to a missing capability check in the wpbs_action_ajax_calendar_remove_note() function, enabling unauthorized modification of data.