WP Booking System: critical flaw in versions up to 2.1.0.5

What it is and who is affectedThe WP Booking System – Booking Calendar plugin for WordPress carries a critical vulnerability tracked as CVE-2026-11655...

What it is and who is affected

The WP Booking System – Booking Calendar plugin for WordPress carries a critical vulnerability tracked as CVE-2026-116557. According to the National Vulnerability Database (NVD) of NIST, the flaw is a missing capability check on the wpbs_action_ajax_calendar_remove_note() function, classified as CWE-862 (missing authorisation).

The practical consequence is unauthorised modification of data: an authenticated attacker with Subscriber-level access or above can delete arbitrary calendar notes belonging to any calendar on the installation. In a booking-driven business, those notes often hold internal context — arrival times, special requests, staff remarks — so losing them silently can disrupt operations long before anyone notices.

Affected versions are up to and including 2.1.0.5. The NVD published the entry on 31 October 2026 with a CVSS 3.1 score of 9.1 (CRITICAL) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The integrity and availability impact is high, while confidentiality is rated as none.

Any WordPress site running the plugin at or below that version is in scope, whether it is a small hotel in Lleida, a rural guesthouse near Girona, a clinic in Tarragona or an online shop in Barcelona that uses bookings as a side service. If the site allows user registration — even as Subscribers — the barrier to exploitation is low.

Why it is urgent

At the time of writing, CVE-2026-116557 does not appear in CISA's KEV catalogue, so there is no public record of it being exploited in real attacks and no federal remediation deadline attached to it. That is not a reason to relax. A critical rating with a network attack vector and no user interaction means the flaw is reachable remotely and cheaply once someone with a Subscriber account decides to try.

WordPress plugins are a habitual entry point precisely because they are numerous, frequently updated and sometimes forgotten. A booking plugin sits on pages that are publicly reachable, and the note-deletion function is exposed through an AJAX action. The window between publication in the NVD and opportunistic scanning is usually short.

What to do today

Confirm whether the plugin is installed and at what version. Check the plugins list in the WordPress dashboard, or the plugin directory on the server. Anything at 2.1.0.5 or below is affected.
Apply the fix indicated in the vendor's advisory. The references point to changes in the plugin's trunk, so consult the official WP Booking System release notes and update to the version the developer designates as corrected. Do not assume a specific number; verify it.
Review for signs of intrusion. Look for unexpected deletions of calendar notes, unfamiliar user accounts with Subscriber or higher roles, and unusual AJAX requests in the web server or plugin logs around the note-removal action.
Reduce what is exposed to the internet. If user registration is not needed, disable it. Tighten role assignments so that only trusted staff hold accounts, and restrict access to wp-admin and admin-ajax.php where your setup allows it.
Keep a recent backup of files and database, stored off the web server, so that notes and bookings can be restored if data is tampered with.

None of these steps requires a large IT department, but they do require someone to actually check. In many small businesses in Catalonia the plugin was installed years ago by an agency or a former employee and nobody has looked at it since.

How a cybersecurity team such as ALMC's can help

Stories like this one are rarely about a single plugin. They are about the long tail of components that make up a WordPress, PrestaShop or Joomla installation and the fact that nobody is watching them between projects. ALMC's cybersecurity work for SMEs starts from that reality: security audits and pentesting to find vulnerabilities before someone else does, hardening of servers and CMS installations, and monitoring with incident response when something looks wrong.

For sites that depend on plugins like WP Booking System, the routine matters more than the emergency. Patch management keeps security updates flowing, maintenance of WordPress, PrestaShop and Joomla keeps the platform and its extensions current, and a clear procedure for reviewing advisories such as CVE-2026-116557 means a critical rating does not sit unread in an inbox. When a site has already been compromised, the team also handles repair of hacked websites and the cleanup that follows.

The lesson from this CVE is simple: a missing capability check in a booking plugin can quietly erase business data. Knowing which versions you run, and acting on the vendor's advisory, closes that gap before it becomes a problem.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.