CVE-2026-92619 in Booking Calendar Plugin
Summary
by MITRE • 09/18/2026
The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as `default_role=administrator` and `users_can_register=1`, then self-registering a new Administrator account. The nonce check does not meaningfully restrict this attack, as both the nonce value and nonce action are attacker-supplied POST parameters, and a valid nonce is trivially obtainable via `admin-ajax.php?action=rest-nonce`.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Booking Calendar plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 11.8.2. This flaw resides within the wpbc_ajax_option_save AJAX action, specifically in the handle_ajax_save function which manages option updates via user-supplied data. The core technical deficiency lies in how the plugin validates and processes configuration options. While the developer implemented safeguards for specific registered options using a register_option_policy mechanism, this security control is incomplete because it only applies to names explicitly whitelisted during registration. For any option name not present in this whitelist, including critical WordPress core settings, the get_option_policy function returns an empty policy object. This absence of a defined policy effectively disables all intended security checks, such as can_save permissions, force_mode restrictions, and allowed_keys filtering mechanisms that are designed to prevent unauthorized modifications.
The exploitation vector relies on the attacker-controlled data_name parameter passing through sanitize_key without sufficient validation against a whitelist before being passed directly to WordPress update_option function. Because there is no restriction preventing writes to core system options, an authenticated user with Editor-level access or higher can manipulate fundamental site configurations. By setting default_role to administrator and users_can_register to 1, the attacker alters the baseline permissions for new accounts and changes the role assigned by default upon registration. This manipulation allows the attacker to subsequently register a new account that is automatically granted Administrator privileges, thereby achieving full control over the WordPress installation despite only possessing lower-level credentials initially.
The vulnerability also bypasses standard nonce verification protections typically employed in AJAX requests within WordPress environments. In this specific implementation, both the nonce value and the associated nonce action are supplied directly by the attacker via POST parameters rather than being generated server-side for a specific context. Consequently, an attacker can trivially obtain a valid nonce by requesting one through admin-ajax.php?action=rest-nonce. This renders the nonce check ineffective as a deterrent against unauthorized actions, allowing the malicious requests to proceed without triggering security blocks that would normally validate the request's origin and intent.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management due to the elevation of user privileges beyond their intended scope. It also corresponds to CWE-732 Incorrect Permission Assignment for Critical Resource because core WordPress options are written without appropriate access controls. In terms of offensive security frameworks, this attack maps to ATT&CK T1078 Valid Accounts and specifically T1098 Account Manipulation as the attacker modifies account settings to gain persistent administrative access. The operational impact is severe, granting attackers complete control over the web application, database integrity, and potentially the underlying server infrastructure if further exploitation chains are pursued.
Mitigation strategies must prioritize immediate patching of the Booking Calendar plugin to a version where this flaw has been resolved by enforcing strict whitelisting for all option updates regardless of registration status. Until an update is available, administrators should restrict access to wp-admin areas and disable unnecessary AJAX endpoints that handle generic option saves. Additionally, implementing stricter server-side validation on data_name parameters to ensure they only match expected configuration keys can provide a temporary defensive layer. Regular auditing of user roles and monitoring for unexpected changes in core WordPress options such as default_role are essential steps to detect potential compromise early.