CVE-2026-116557 is a missing authorization check in the WP Booking System – Booking Calendar plugin for WordPress, through version 2.1.0.5, that lets low-privileged authenticated users delete calendar notes on any calendar.
What Is It
The flaw is in the plugin's wpbs_action_ajax_calendar_remove_note() function, which does not perform a capability check. Wordfence reported it, and NVD classifies it as CWE-862 (Missing Authorization). Any authenticated attacker with Subscriber-level access or higher can delete arbitrary calendar notes that belong to any calendar on the site.
NVD published the record on 2026-10-31. Its status is "Received", which means NVD has not yet completed its own analysis.
Why It Matters
Wordfence scored the flaw 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. It can be attacked over the network with low complexity and no user interaction. The impact on integrity and availability is high, and there is no impact on confidentiality.
The scoring and the written description don't fully agree. The CVSS vector says no privileges are required (PR:N), but the description says the attacker needs Subscriber-level access or higher. On WordPress sites that allow open user registration, Subscriber accounts are often easy to get, so the practical barrier may be low either way.
As of 2026-10-31, CVE-2026-116557 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog. That means there is no CISA-required action or due date, and active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: murgroland
- Product: WP Booking System – Booking Calendar (WordPress plugin)
- Affected versions: all versions up to and including 2.1.0.5
No affected CPEs are listed in the NVD record yet.
Patch Status
The NVD references include a WordPress plugin Trac changeset (3765778) that modifies functions-notes.php in the plugin trunk. This appears to be the code fix. The references do not name a fixed release version.
Site owners running version 2.1.0.5 or earlier should do two things:
- Update to the latest plugin release once it includes the changeset.
- Until then, review whether open Subscriber registration is enabled and restrict it if possible.