# CVE-2026-109369: WP Booking System authorization bypass in form access control

Source: https://junglewise.ai/threats/cve-2026-109369-the-wp-booking-system-booking-calendar-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-109369 · Severity: medium · CVSS 6.8 · Published 2026-10-17

The WP Booking System – Booking Calendar plugin for WordPress allows authenticated users with access to one booking form to escalate their privileges and grant themselves edit access to all booking forms on the site. An attacker who has been delegated rights to manage a single booking form can abuse a nonce validation flaw to modify access controls for every other booking form, potentially exposing sensitive booking data or allowing unauthorized modifications across the entire booking system.

Technologies: [WP Booking System – Booking Calendar](https://junglewise.ai/threats/technologies/wp-booking-system-booking-calendar-1). Vendors: [WP Booking System](https://junglewise.ai/threats/vendors/wp-booking-system).

## Quick answers

**Is CVE-2026-109369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109369 being exploited in the wild.

**How severe is CVE-2026-109369?** Medium severity, with a CVSS score of 6.8, published 17 October 2026.

**Which products and versions are affected?** WP Booking System – Booking Calendar up to and including 2.1.0.3.

**Is there a fix for CVE-2026-109369?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109369 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109369?** Check whether you run WP Booking System – Booking Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to properly verify user authorization when handling access control updates, allowing authenticated attackers with subscriber-level access and at least one delegated form edit right to overwrite the user_permission meta that controls access to other booking forms. By harvesting a valid wpbs_edit_form nonce from an authorized form and reusing it against other forms, an attacker can bypass the access control checks. This is a privilege escalation vulnerability requiring prior delegation of edit rights to at least one booking form.

## Affected products

- WP Booking System WP Booking System – Booking Calendar up to and including 2.1.0.3

## Timeline

- 2026-10-17: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/form/functions-actions-form.php](https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/form/functions-actions-form.php)
- [https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/functions.php](https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.2/includes/base/admin/functions.php)

## Related threats

- [WP Booking System Booking Calendar authorization bypass in note deletion](https://junglewise.ai/threats/cve-2026-116557-the-wp-booking-system-booking-calendar-plugin-for-wordpress-is)