External risk intelligence

WP Booking System Calendar Note Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-116557

The vulnerability affects a WordPress plugin designed for public-facing websites. As a booking and calendar system, these plugins are typically installed on web applications accessible to the public internet to facilitate user interaction and scheduling, making the vulnerable functionality reachable via standard web traffic.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in the WP Booking System plugin for WordPress. The flaw allows authenticated users with basic access to delete any calendar notes within the system, potentially disrupting scheduling and data integrity. The main concern is confirming relevance and exposure of this plugin within our WordPress environment.

Authenticated users can delete any calendar notes.
Protects scheduling data integrity and operational continuity.
Confirm plugin use and assess impact.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by first gaining access to a WordPress site as a user with a Subscriber role or higher. With this access, they can then interact with the booking calendar's AJAX functionality to send a request to the `wpbs_action_ajax_calendar_remove_note()` function. This function, lacking a proper check for user permissions, will then delete arbitrary calendar notes, impacting data integrity and availability.

Authenticated access required.
Arbitrary deletion of calendar notes.
Unauthorized data modification and loss.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow authenticated users with low-level access to delete any calendar notes within the booking system. This occurs when the system fails to properly check user permissions before executing a function designed to remove calendar notes.

Calendar notes could be deleted.
Notes may be removed by unauthorized users.
Calendar data integrity is compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this vulnerability in the WP Booking System plugin, the application owner and the web infrastructure team are likely responsible for remediation. The first practical step is to identify all WordPress instances running the affected plugin, determine if they are externally accessible or host critical business data, and then assign ownership to the relevant team for risk-based remediation planning.

Application owners should own the issue.
Verify plugin reachability and critical data.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Booking System plugin?

The WP Booking System is a WordPress plugin used to manage calendars, availability, and scheduling directly on a website. It allows site administrators to display booking forms and track reservations. Users typically interact with these calendars to see dates or submit booking requests, making it a functional component for service-based websites that rely on direct customer interaction for appointments or resource management.

What does CWE-862 mean for CVE-2026-116557?

CWE-862 is the classification for Missing Authorization. In plain terms, this means the software performs an action without verifying if the user has the necessary permission to do so. For this specific CVE, the plugin executes a function to remove calendar notes without checking if the person requesting the deletion is authorized, allowing users with low-level access to perform actions meant only for administrators.

How can an attacker trigger this vulnerability?

To trigger this, an attacker must have an account on the WordPress site with at least Subscriber-level access. They send a specific request to the vulnerable AJAX function within the plugin. Importantly, this does not require administrative privileges or complex exploits; if a user has basic login access to the site, the system fails to block their attempt to delete notes that do not belong to them.

Is my site at risk according to Halo Surface Signal?

Yes, if your site is internet-facing, it is at higher risk. Halo Surface Signal identifies this as a likely concern because WordPress booking plugins are intentionally designed to be accessible to the public internet. Since these tools are meant to facilitate scheduling for site visitors, the vulnerable functionality is inherently reachable via standard web traffic, increasing the likelihood of unauthorized interaction.

What should I do if I use this plugin?

Your first step is to audit your WordPress environment to identify every instance where the WP Booking System is installed. Once you have a list of affected sites, prioritize those that are internet-facing or hold critical scheduling data. Work with your web infrastructure or application teams to assess the risk and plan the necessary updates to remove the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.