{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-92619",
        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "state": "PUBLISHED",
        "assignerShortName": "Wordfence",
        "dateReserved": "2026-09-16T14:45:02.914Z",
        "datePublished": "2026-09-18T06:38:54.974Z",
        "dateUpdated": "2026-09-18T06:38:54.974Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
                "shortName": "Wordfence",
                "dateUpdated": "2026-09-18T06:38:54.974Z"
            },
            "affected": [
                {
                    "vendor": "wpdevelop",
                    "product": "Booking Calendar",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "11.8.2",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as `default_role=administrator` and `users_can_register=1`, then self-registering a new Administrator account. The nonce check does not meaningfully restrict this attack, as both the nonce value and nonce action are attacker-supplied POST parameters, and a valid nonce is trivially obtainable via `admin-ajax.php?action=rest-nonce`."
                }
            ],
            "title": "Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter",
            "references": [
                {
                    "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab68a6b2-e9b0-4efa-bd01-c6e3e11011db?source=cve"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/booking/tags/11.8.2/includes/save-load-option/save-load-option.php#L303"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/booking/tags/11.8.2/includes/save-load-option/save-load-option.php#L197"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/booking/tags/11.8.2/includes/save-load-option/save-load-option.php#L138"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/browser/booking/tags/11.8.2/includes/page-form-builder/ajax/bfb-ajax.php#L82"
                },
                {
                    "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3699185%40booking&new=3699185%40booking"
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "description": "CWE-269 Improper Privilege Management",
                            "cweId": "CWE-269",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.2,
                        "baseSeverity": "HIGH"
                    }
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Wordfence PRISM"
                }
            ],
            "timeline": [
                {
                    "time": "2026-09-16T14:48:37.000Z",
                    "lang": "en",
                    "value": "Vendor Notified"
                },
                {
                    "time": "2026-09-17T18:25:01.000Z",
                    "lang": "en",
                    "value": "Disclosed"
                }
            ]
        }
    }
}