CVE-2026-105195— Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
Quick assessment
Affected
Unknown Booking Calendar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Booking Calendar WordPress 插件在 11.8.3 版本之前存在一个安全漏洞，该漏洞未能充分限制低权限用户通过其设置处理器加载哪些选项。此漏洞允许具有编辑者（Editor）角色及更高级别权限的用户泄露任意 WordPress 选项的值，包括核心网站配置信息。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105195
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Booking Calendar | 10.15 ~ 11.8.3 | - |
|
II. Public POCs for CVE-2026-105195
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105195
请登录查看更多情报信息。
Other References for CVE-2026-105195 (1)
-
https://wpscan.com/vulnerability/9d6e9047-410e-4d3d-81f0-e3f89cf7a494/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-08 · 24 CVEs total
| CVE-2026-93509 | 6.5 MEDIUM | Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via |
| CVE-2026-103517 | 5.3 MEDIUM | Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Web |
| CVE-2026-104671 | 5.3 MEDIUM | TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX |
| CVE-2026-105190 | 5.3 MEDIUM | Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabl |
| CVE-2026-103309 | GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage | |
| CVE-2026-103646 | Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Pa | |
| CVE-2026-104646 | Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortc | |
| CVE-2026-104645 | Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Im | |
| CVE-2026-103692 | Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Func | |
| CVE-2026-105197 | LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR | |
| CVE-2026-105198 | LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR | |
| CVE-2026-105194 | Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Dow | |
| CVE-2026-105196 | LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API | |
| CVE-2026-105193 | Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification | |
| CVE-2026-86826 | BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory | |
| CVE-2026-86827 | BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php | |
| CVE-2026-86828 | BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback | |
| CVE-2026-105260 | Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF | |
| CVE-2026-94246 | Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Reques | |
| CVE-2026-94244 | Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosu |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Booking Calendar
-
CVE-2026-105193
Booking Calendar < 11.8 - Unauthenticated Booking Informatio -
CVE-2026-39601
WordPress Booking Calendar plugin <= 11.8.4 - Race Condition -
CVE-2026-93655
Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting -
CVE-2026-92561
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting -
CVE-2026-92619
Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privile
Same vendor: Unknown
-
CVE-2026-105190
Easy Digital Downloads < 3.7.1 - Unauthenticated Account Cre -
CVE-2026-93509
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ W -
CVE-2026-103517
Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated -
CVE-2026-104671
TutorStarter < 4.0.4 - Unauthenticated User Registration Byp -
CVE-2026-94245
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ A
V. Comments for CVE-2026-105195
No comments yet