CVE-2026-91025: Booking Manager WordPress Auth Bypass Flaw

CVE-2026-91025 Overview

CVE-2026-91025 is an Insecure Direct Object Reference (IDOR) vulnerability in the Booking Manager WordPress plugin before version 2.1.21. The plugin fails to verify that a request modifying a user's plugin-specific settings targets the requesting user's own account. Any authenticated user with subscriber-level access or above can create or overwrite per-user Booking Manager settings on arbitrary user accounts, including administrators. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Low-privileged authenticated users can overwrite plugin-specific settings on any account, including administrators, enabling integrity impact across the WordPress site.

Affected Products

• Booking Manager WordPress plugin versions prior to 2.1.21
• WordPress installations exposing the plugin's authenticated settings endpoint
• Multi-user WordPress sites permitting subscriber-level registration

Discovery Timeline

• 2026-09-23 - CVE-2026-91025 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91025

Vulnerability Analysis

The Booking Manager plugin exposes an authenticated endpoint that writes per-user plugin settings. The handler accepts a user identifier from the request but does not check whether the identifier matches the authenticated session's user ID. As a result, any logged-in user can supply another user's ID and cause the plugin to persist settings against that account. The vulnerability requires only subscriber-level privileges, which is the lowest authenticated role in WordPress. Because the target user ID can be an administrator, an attacker can influence booking-related configuration or state stored for privileged accounts. Confidentiality is not affected, but integrity of stored per-user settings is compromised. The issue maps to CWE-639, where authorization decisions rely on a user-controlled key rather than the authenticated session context.

Root Cause

The root cause is missing ownership validation in the settings-update handler. The plugin trusts the user identifier supplied in the request instead of deriving the target from the authenticated session. No capability check confirms that the caller may modify the target account's plugin settings.

Attack Vector

Exploitation occurs over the network against a WordPress site running Booking Manager before 2.1.21. The attacker authenticates as a subscriber, then issues a crafted request to the plugin's settings endpoint specifying a victim user ID such as an administrator account. The server writes the attacker-supplied settings to the target user record without further authorization checks. No user interaction is required from the victim.

No verified public proof-of-concept is available. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-91025

Indicators of Compromise

• Unexpected changes to Booking Manager per-user settings stored in wp_usermeta for administrator or editor accounts
• Authenticated POST requests to Booking Manager settings endpoints where the request-supplied user ID differs from the session user
• New or modified plugin option entries created by low-privileged accounts shortly after account registration

Detection Strategies

• Review WordPress audit logs for settings-modification actions performed by subscriber-level accounts
• Correlate authenticated HTTP requests against the plugin's settings handler with the target user ID parameter and compare to the session cookie owner
• Baseline the Booking Manager plugin version across managed sites and flag any instance below 2.1.21

Monitoring Recommendations

• Enable WordPress activity logging plugins to capture user meta updates with actor identity
• Monitor web server access logs for repeated POST requests to Booking Manager admin-ajax or REST routes from newly created subscriber accounts
• Alert on modifications to administrator user meta initiated by non-administrator sessions

How to Mitigate CVE-2026-91025

Immediate Actions Required

• Upgrade the Booking Manager WordPress plugin to version 2.1.21 or later on all affected sites
• Audit administrator and editor accounts for unauthorized changes to Booking Manager per-user settings
• Restrict new subscriber registration on sites where self-service accounts are not required

Patch Information

The vendor addressed the vulnerability in Booking Manager version 2.1.21 by enforcing that settings updates apply only to the authenticated user's own account. Refer to the WPScan Vulnerability Report for advisory details and upgrade guidance.

Workarounds

• Temporarily deactivate the Booking Manager plugin until the site can be upgraded to 2.1.21
• Disable public user registration or set the default new-user role to a custom role without access to plugin AJAX endpoints
• Deploy a Web Application Firewall (WAF) rule blocking authenticated requests to Booking Manager settings endpoints where the request user ID does not match the session user

# Configuration example: disable open registration and enforce default role via wp-config.php / WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin update booking-manager --version=2.1.21