CVE-2026-105195

Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.

Affected

Booking Calendar

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.23% chance of exploitation in the next 30 days, 13th percentile

Published

2026-10-08

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9d6e9047-410e-4d3d-81f0-e3f89cf7a494/

References

• CVE Record
• NVD entry