CVE-2026-116557
validatedZero produced an exploit or a check.description
WP Booking System – Booking Calendar through version 2.1.0.5 lacks an authorization check when removing calendar notes. An authenticated user with Subscriber-level access or higher can delete notes from arbitrary calendars. Exploitation requires a valid WordPress account with at least Subscriber permissions.
mitigation
Restrict or remove Subscriber-level accounts that are not needed, and limit access to the affected plugin while awaiting a vendor update. Review calendar notes and WordPress account permissions for unauthorized changes.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-31 06:44Zcve_org: trigger signal, started the run
- 2026-10-31 07:01Z
this entry in the feed
GET /api/v1/feed/CVE-2026-116557
{ "etk_id": "ETK-2026-3152", "cve_id": "CVE-2026-116557", "display_id": "CVE-2026-116557", "ghsa_id": null, "euvd_id": "EUVD-2026-114610", "status": "published", "anchor_state": "anchored", "title": "Missing authorization in WP Booking System calendar notes", "summary": "WP Booking System – Booking Calendar through version 2.1.0.5 lacks an authorization check when removing calendar notes. An authenticated user with Subscriber-level access or higher can delete notes from arbitrary calendars. Exploitation requires a valid WordPress account with at least Subscriber permissions.", "mitigation": "Restrict or remove Subscriber-level accounts that are not needed, and limit access to the affected plugin while awaiting a vendor update. Review calendar notes and WordPress account permissions for unauthorized changes.", "vendor": "murgroland", "product": "WP Booking System – Booking Calendar", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 2.1.0.5" ], "ecosystem": null, "fixed_versions": [], "package_name": "WP Booking System – Booking Calendar", "purl": null } ], "cwes": [ 862 ], "cvss_score": 9.1, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.26157071666666665, "t0_at": "2026-10-31T06:44:21.690000+00:00", "signals": { "check": { "at": "2026-10-31T07:01:01.719107+00:00", "days": 0.011574410960648148, "is_lower_bound": false, "measured_at": "2026-10-31T06:44:21.690000+00:00", "url": null }, "trigger_signal": { "at": "2026-10-31T06:44:21.690000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-31T06:44:21.690000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-116557" } } }
published 2026-10-31 07:00Z
last change 2026-10-31 09:30Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.