The WP Booking System – Booking Calendar plugin contains an authorization bypass that allows any authenticated user with subscriber-level access or higher to elevate privileges. By modifying the 'user_permission' parameter, the attacker can grant edit rights to themselves and arbitrary other users for every booking form. This vulnerability is rooted in an improper authorization check (CWE-862) and could let an attacker perform unauthorized edits that may disrupt availability, compromise data integrity, or expose sensitive booking details.

All plugin releases up to and including 2.1.0.3 are affected. The product is the WP Booking System – Booking Calendar plugin published by murgroland. Any WordPress installation running any of these versions is vulnerable unless the plugin has been upgraded to a later release.

The CVSS score of 6.8 indicates a moderate severity, while the EPSS score is unavailable, so the current exploitation probability cannot be determined. The vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated and possess edit rights on at least one booking form, which then allows them to harvest a valid wpbs_edit_form nonce. From that point, the attacker can reuse the nonce across other forms—so the attack vector requires an authenticated session but can be carried out against any form on the site. If exploited, the attacker could shift to full administrative control over booking configurations and potentially compromise other site functions that rely on booking data.