CVE-2026-116557

Name of the Vulnerable Software and Affected Versions WP Booking System - Booking Calendar plugin for WordPress versions prior to 2.1.0.6

Description An authorization flaw exists where a missing capability check in the wpbs action ajax calendar remove note() function allows authenticated users with Subscriber-level access and above to delete arbitrary calendar notes from any calendar.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.