CVE-2025-10124 - Booking Manager < 2.1.15 - Contributor+ Booking Deletion

Back Back to CVE browser

MEDIUM

Booking Manager < 2.1.15 - Contributor+ Booking Deletion

Published Oct 10, 2025

4.5

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.

Affected products

Vendor n/a Product Booking Manager Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.1.15

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Booking Manager

unaffected

Version	Status	Constraints
0	affected	<2.1.15

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33661
Advisory
https://wpscan.com/vulnerability/9bb0589f-34bb-40e1-b7f0-ee883b7b896c/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33661		Advisory
https://wpscan.com/vulnerability/9bb0589f-34bb-40e1-b7f0-ee883b7b896c/		exploitvdb-entrytechnical-description