CVE-2026-105195 — Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure

CVE-2026-105195

Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure PUBLISHED

Description (CNA)

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.

Affected (CNA)

Vendor / product	Versions
Unknown / Booking Calendar	affected 10.15 before 11.8.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/9d6e9047-410e-4d3d-81f0-e3f89cf7a494/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.