CVE-2026-9851

Name of the Vulnerable Software and Affected Versions Booking Package versions prior to 1.7.17

Description An issue allows authenticated attackers with Editor-level access and above to perform privilege escalation via account takeover. This occurs due to a missing capability check on the 'updateUser' branch of the 'package app action' AJAX endpoint. The handler validates only a nonce, and the dispatcher invokes the Schedule::updateUser() function with the $administrator argument hard-coded to 1. This bypasses the owner-restriction check, allowing the target user to be determined by attacker-supplied input passed to wp update user(). Consequently, attackers can change the email address and password of any account, including Administrator accounts, leading to a full site takeover.

Recommendations Update the plugin to a version later than 1.7.16.