CVE-2026-91025 - Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

Back Back to CVE browser

MEDIUM

Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

Published Sep 23, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.15%

Description

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.

Affected products

Vendor n/a Product Booking Manager Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.1.21

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Booking Manager

unaffected

Version	Status	Constraints
0	affected	<2.1.21

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85057
Advisory
https://wpscan.com/vulnerability/6e010e3e-78e8-4bfc-b880-d9a85cff2c2a/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85057		Advisory
https://wpscan.com/vulnerability/6e010e3e-78e8-4bfc-b880-d9a85cff2c2a/		exploitvdb-entrytechnical-description