Executive brief
The Booking Calendar plugin for WordPress allows authenticated users with Editor-level permissions to escalate their account privileges to Administrator. An attacker can exploit a flaw in the plugin's option-saving mechanism to modify core WordPress settings, create a new Administrator account, and gain full control of the website. This puts customer data, site functionality, and business reputation at severe risk.
Technical details
The vulnerability is a privilege escalation flaw in the `handle_ajax_save()` function of the Booking Calendar plugin. The function fails to validate access controls for unregistered WordPress options, bypassing all `can_save`, `force_mode`, and `allowed_keys` checks when an attacker supplies an unregistered option name via the `wpbc_ajax_option_save` AJAX action. An authenticated attacker with Editor-level access or above can exploit this to modify core WordPress options such as `default_role` and `users_can_register`, then self-register a new Administrator account. Although a nonce check exists, it is ineffective because both the nonce value and action are attacker-controlled POST parameters, and a valid nonce can be trivially obtained via the `admin-ajax.php?action=rest-nonce` endpoint. The vulnerability affects all versions up to and including 11.8.2.
Affected products
- Team Booking Booking Calendar up to 11.8.2
Timeline
- 2026-09-18: disclosed