CVE-2026-9851 — Vulnerability Advisory

Overview

Summary

The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.

Risk profile

CVSS assessment

7.2 · H I G H

Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector: N E T W O R K
Complexity: L O W
Privileges: H I G H
User interaction: N O N E
Scope: U N C H A N G E D
Confidentiality: H I G H
Integrity: H I G H
Availability: H I G H

Classification

Weaknesses

Authorization Bypass Through User-Controlled Key CWE-639

References

5 sources