4.3
Moyenne
CVE-2026-91025 The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager …
Description
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Booking Manager 2.1 | premières → < 2.1.21 | 2.1.21 |
Autres CVE de Booking Manager
Les 4 CVE de Booking Manager →
CVE-2026-91024
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external…
6.8
Moyenne
CVE-2025-10124
The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode…
4.5
Moyenne
CVE-2023-1977
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for…
Non notée