Low severity · published Oct 8, 2026
CVE-2026-105195
Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
2.7
CVSS
0.2%
EPSS
No
On KEV
Description
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Booking Calendar ·
10.15 before 11.8.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105195
exploit
https://wpscan.com/vulnerability/9d6e9047-410e-4d3d-81f0-e3f89cf7a494/
More from Booking Calendar
4.8
CVE-2026-105193
Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash