CVE-2026-109369

Executive Summary

CVE-2026-109369 is an authorization bypass (CWE-862, "Missing Authorization") in the WP Booking System – Booking Calendar WordPress plugin affecting all versions up to and including 2.1.0.3. An authenticated attacker holding only subscriber-level access can escalate privileges by overwriting the plugin's own access-control list (the user_permission user meta), granting themselves and arbitrary other users edit access to every booking form on the site. The attack is gated by a real precondition — the attacker must already have been delegated edit rights on at least one booking form — which aligns with the assigned CVSS 3.1 base score of 6.8 (AC:H, PR:L). No public exploit, PoC, or Nuclei template is currently available, and the vulnerability is not in CISA KEV.

Technical Analysis

The flaw is a classic missing-authorization condition in a WordPress plugin. WordPress sites commonly store per-user capabilities and permissions as entries in the wp_usermeta table, and plugins often manage their own internal access-control lists (ACLs) the same way. Per the NVD description, WP Booking System stores a user_permission meta value that governs which booking forms a given user is allowed to edit. The plugin performs authorization checks based on this meta value but fails to properly verify that the requesting user is authorized to modify the meta in the first place — so a low-privileged authenticated user can write to it.

Two design weaknesses combine to make this exploitable:

1. Submenu capability downgrade. When a user has been delegated edit rights on at least one booking form, the plugin downgrades the capability required to access its submenu to read. read is the baseline capability held by every logged-in WordPress user, including Subscribers. This means the plugin's admin-side edit page becomes reachable by a subscriber who has ever been delegated rights on any single form, rather than remaining gated behind a capability like manage_options or an edit-forms-specific capability.

2. Nonce scope insufficiently bound to the target object. The plugin issues a nonce named wpbs_edit_form for the edit action. Per the description, a valid wpbs_edit_form nonce harvested while editing the one form the attacker legitimately controls will pass validation against any other form_id. In other words, the nonce is validated for "the user can do the edit action" rather than being bound to ("the user can edit this specific form"). WordPress nonces are not per-object authorization tokens by design, so using a single action-scoped nonce across all form IDs is a common but incorrect pattern.

The exact sink that writes user_permission is not disclosed in the description, so the specific request handler, parameter names beyond wpbs_edit_form, and form_id are not confirmed here. What can be stated with confidence: because both the page gate and the nonce gate are satisfiable by a subscriber with a single delegated form, the remaining check — "is this user allowed to grant edit access on the requested form(s)?" — is either absent or not enforced against the meta write. The attacker therefore reaches the code path that persists user_permission and can set it to a value that confers edit rights across the entire site.

The CVSS vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N is consistent with this: network-reachable, requires a low-privilege authenticated account plus the specific precondition (hence High attack complexity), no user interaction, scoped to the application, with high confidentiality and integrity impact but no direct availability impact. The confidentiality impact derives from the fact that booking forms can contain customer PII submitted through the calendar, and from the attacker's ability to read the permission state of arbitrary users; the integrity impact derives from unauthorized modification of booking forms and of the access-control list itself.

Exploitation Scenarios

The following chain is derived strictly from the NVD description. No public PoC exists; the sequence below describes the vulnerability class and the specific gating conditions disclosed, not a confirmed exploit script.

1) Reconnaissance / precondition establishment. The attacker needs an authenticated account on the target WordPress site. Subscriber-level registration is frequently open on WordPress sites (default registration role, membership plugins, comment-account creation). The critical precondition is that the attacker — or a colluding account — must already hold delegated edit rights on at least one booking form. This delegation is the normal, intended administrative action an operator performs to let a staff member manage a specific calendar. An attacker who can social-engineer or otherwise obtain such a delegation, or who has a compromised low-privileged staff account, satisfies the precondition.

2) Triggering the flaw class. With delegation in place, the plugin has downgraded its submenu capability to read. The subscriber/attacker can therefore navigate to the booking-form edit page for their one delegated form. While there, the attacker captures the wpbs_edit_form nonce that the plugin emits for the edit action. Because that nonce is validated against the action rather than against a specific form ID, it is reusable across every form on the site.

3) Payload / execution method. The attacker submits a request to the plugin's edit handler, supplying the harvested wpbs_edit_form nonce and a form_id corresponding to a form they were never delegated. The authorization check on the meta write is missing, so the request is processed and the plugin persists an updated user_permission meta value. The attacker sets this value to grant edit access — for their own account and for arbitrary other users — on every booking form. No specific parameter names beyond those disclosed are asserted here.

4) Post-exploitation impact. Once user_permission is overwritten, the attacker (or accounts they nominate) can view and modify all booking forms site-wide: pricing, availability, form fields, notification recipients, and any customer data the calendars capture. Because the access-control list itself is the object being tampered with, the compromise is persistent and self-reinforcing — the attacker can re-grant their elevation after any administrative clean-up unless the vulnerable meta is removed and the plugin is patched.

Impact Assessment

Successful exploitation yields full unauthorized control over the booking-form configuration layer of the affected WordPress installation. Using the CVSS 3.1 subscores:

• Confidentiality: High. The attacker gains read access to every booking form, and booking data commonly contains customer names, email addresses, phone numbers, and free-text special requests — i.e., regulated PII in many jurisdictions.
• Integrity: High. The attacker can alter forms used to collect customer submissions, potentially redirecting notifications to attacker-controlled mailboxes or modifying parameters that downstream booking logic depends on.
• Availability: None. The vector records A:N; the flaw is not described as causing denial of service.
• Attack Vector: Network, PR:L, AC:H, UI:N. Exploitation is remote but requires an authenticated account and the pre-existing single-form delegation. The High complexity score reflects that dependency rather than any cryptographic barrier.

Blast radius is site-wide with respect to the plugin: every booking form is reachable once the meta is overwritten. Sites that use open registration, that have multiple delegated staff accounts, or that run the plugin on customer-facing booking portals are most exposed. Because the elevation persists in user meta, a naive "delete the attacker's account" response is insufficient if other users were also nominated.

Detection Guidance

Sigma Rule

title: WP Booking System user_permission Meta Tampering via Edit Form
id: 5f2b9c1e-3a7d-4c8e-9b1a-cve2026109369
status: experimental
description: Detects requests to the WordPress booking-form edit endpoint that carry a wpbs_edit_form nonce alongside a user_permission update, consistent with CVE-2026-109369 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109369
author: valtersit.com threat intelligence
logsource:
  category: webserver
  product: apache
  service: http
detection:
  selection_request:
    cs-method: 'POST'
    cs-uri-query|contains|all:
      - 'page='
      - 'wpbs'
  selection_nonce:
    cs-uri-query|contains: 'wpbs_edit_form'
  selection_meta:
    cs-uri-query|contains: 'user_permission'
  condition: selection_request and (selection_nonce or selection_meta)
fields:
  - c-ip
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrators editing plugin permissions
level: medium
tags:
  - attack.t1548
  - cve.2026-109369

YARA Rule

rule CVE_2026_109369_WP_Booking_System_Authz_Bypass
{
    meta:
        description = "Detects WP Booking System plugin artifacts associated with CVE-2026-109369 authorization bypass"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109369"
        cve = "CVE-2026-109369"
        date = "2026-01-01"

    strings:
        $plugin_dir = "wp-booking-system" ascii wide nocase
        $nonce_name = "wpbs_edit_form" ascii wide
        $meta_key   = "user_permission" ascii wide
        $form_id    = "form_id" ascii wide
        $nonce_func = "wp_verify_nonce" ascii wide

    condition:
        $plugin_dir and $nonce_name and $meta_key and any of ($form_id, $nonce_func)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109369 WP Booking System authorization bypass attempt (wpbs_edit_form nonce + user_permission meta)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"admin"; nocase; http.uri; content:"wpbs_edit_form"; nocase; http.uri; content:"user_permission"; nocase; sid:2026109369; rev:1; metadata:cve CVE-2026-109369, attack_target Web_Server, signature_severity Major, created_at 2026_01_01; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ network where http.request.method == "POST" and
      stringContains(network.protocol, "http") == false and
      url.query contains "wpbs_edit_form" ]

A more directly usable EQL query against web server logs is:

any where http.request.method == "POST" and
  process.name : ("php-fpm*", "apache2", "nginx") and
  url.full : ("*wpbs_edit_form*" and ("*user_permission*" or "*form_id*"))

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri)
| where method="POST" AND match(uri_lower, "wpbs")
| eval has_nonce = if(match(uri_lower, "wpbs_edit_form"), 1, 0)
| eval has_meta  = if(match(uri_lower, "user_permission"), 1, 0)
| eval is_edit   = if(match(uri_lower, "form_id="), 1, 0)
| where has_nonce=1 OR has_meta=1
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses by src_ip, uri
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="cve_2026_109369,web,wordpress,">
  <rule id="2026109369" level="10" frequency="3" timeframe="300">
    <if_matched_sid>31103</if_matched_sid>
    <match>wpbs_edit_form</match>
    <description>CVE-2026-109369: WP Booking System edit nonce observed in repeat web requests (possible authorization bypass)</description>
    <mitre>
      <id>T1548</id>
    </mitre>
  </rule>
  <rule id="2026109370" level="12">
    <if_sid>31103</if_sid>
    <match>user_permission</match>
    <description>CVE-2026-109369: user_permission meta tampering attempt against WP Booking System</description>
    <mitre>
      <id>T1548</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch via NVD only; not independently confirmed).

1. Immediate mitigations (before a verified patch is applied):

   • Restrict booking-form delegation. Audit which WordPress accounts hold delegated edit rights on any booking form and remove delegations from all but a tightly controlled staff group. Because a single delegation is sufficient to satisfy the precondition, every unnecessary delegation is an exposed foothold.
   • Tighten registration: disable open user registration or force new registrations to a non-Subscriber role that cannot be used to satisfy the precondition.
   • Audit and snapshot the user_permission user meta across all accounts (in wp_usermeta). Record current values, then monitor for unexpected changes. If feasible, add a database-level trigger or scheduled integrity comparison against the known-good snapshot.
   • Restrict write access to plugin admin endpoints to trusted IP ranges via WAF or web-server ACL where operationally possible.
   • If the plugin's booking-form delegation feature is not required, decommission it entirely for the duration.

2. Patch / upgrade steps:

   • Check the WP Booking System plugin vendor changelog and wordpress.org plugin repository for a release newer than 2.1.0.3 that explicitly addresses authorization on the permission meta. The data supplied does not identify a fixed version, so treat the vendor advisory as authoritative.
   • Back up the database (particularly wp_usermeta and the plugin's booking tables) before upgrading.
   • After upgrading, verify that (a) the submenu no longer downgrades to read for delegated users, and (b) a wpbs_edit_form nonce issued for form A is rejected for form B. These are the two gating behaviors described in the CVE and are the direct observable proof of a fix.
   • Re-audit user_permission after patching to roll back any elevation introduced before the fix.

3. Long-term hardening:

   • Enforce least privilege on WordPress roles; treat Subscriber as the default unprivileged role and never delegate plugin administrative functions to it.
   • Monitor for nonces being reused across object IDs — this is a recurring WordPress plugin pattern and warrants a code review of any installed plugin that stores its own ACL.
   • Apply virtual patching at the WAF layer for any plugin whose patch confidence is below 4/4 until an independently verified fix exists.
   • Maintain continuous inventory of WordPress plugins and versions so that future advisories can be correlated against installed software.

References

• NVD — CVE-2026-109369: https://nvd.nist.gov/vuln/detail/CVE-2026-109369
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• First.org CVSS v3.1 specification — https://www.first.org/cvss/v3-1/specification-document
• WordPress Plugin Security Handbook (nonce and capability guidance) — https://developer.wordpress.org/plugins/security/
• MITRE ATT&CK T1548 — Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/

No threat-actor campaign or in-the-wild exploitation evidence has been reported as of the available data. CISA KEV status: not listed. No public PoC or Nuclei template exists; the analytical chain above is derived from the NVD description and the CVSS 3.1 vector provided.