CVE-2026-116557 - WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
CVE ID :CVE-2026-116557 Published : Oct. 31, 2026, 7:16 a.m. | 44 minutes ago Description :The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function...