CVE-2026-105195 in Booking Calendar Plugin
Summary
by MITRE • 10/08/2026
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Booking Calendar versions prior to 11.8.3 represents a critical failure in access control mechanisms within the plugin's administrative interface. This flaw stems from an improper restriction on input validation and authorization checks for specific settings handlers. Specifically, the application fails to verify whether the user initiating the request possesses sufficient privileges to view or modify certain configuration parameters. While WordPress enforces role-based permissions at various levels, this particular handler bypasses those safeguards by allowing users with elevated roles, such as Editor and above, to trigger operations that expose sensitive system data without adequate verification of their intent or authority relative to the specific option being accessed.
From a technical perspective, the core issue lies in the lack of granular permission checks for arbitrary WordPress options. The plugin's code allows these higher-privileged users to load configuration values through an endpoint that does not properly sanitize or authorize access based on the sensitivity of the data requested. This results in an insecure direct object reference scenario where the identifier used to request a setting is directly mapped to internal system variables without validating if the requesting user should have visibility into those specific variables. Consequently, any authenticated user with Editor privileges or higher can exploit this logic flaw to retrieve values that are intended for administrative use only, such as database credentials, API keys, or other core site configurations stored in the WordPress options table.
The operational impact of this vulnerability is significant due to its potential for information disclosure and subsequent privilege escalation. By exposing arbitrary WordPress option values, an attacker can gather critical intelligence about the target environment. This may include discovering database connection strings, which could lead to direct database access if combined with other vulnerabilities or misconfigurations. Furthermore, exposure of API keys or authentication tokens allows attackers to interact with external services integrated into the site, potentially leading to further compromise of third-party accounts or data breaches. In a multi-site WordPress installation, this vulnerability could also facilitate lateral movement by exposing configuration details that help an attacker map out the broader network infrastructure and identify additional targets for exploitation.
This flaw aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-284 Improper Access Control and CWE-209 Generation of Error Message Containing Sensitive Information, depending on how the data is returned to the user. In terms of the MITRE ATT&CK framework, this vulnerability facilitates reconnaissance activities, specifically mapping it to techniques like T1505.003 Server Software Component: Web Shell or more accurately T1087.002 Account Discovery: Local Account for gathering information about local accounts and system configuration. The ability to read arbitrary options is a precursor step often used in advanced persistent threat scenarios where attackers seek to understand the environment before deploying malware or escalating privileges further.
To mitigate this vulnerability, immediate action must be taken by updating the Booking Calendar plugin to version 11.8.3 or later, which addresses these access control deficiencies. Administrators should also implement strict input validation and ensure that all administrative endpoints perform rigorous authorization checks against the current user's capabilities using WordPress functions like current_user_can with appropriate capability strings rather than relying solely on role names. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking anomalous requests aimed at extracting sensitive configuration data. Regular security audits and code reviews focusing on access control logic are recommended to prevent similar issues in custom plugins or themes that interact with the WordPress core options API.