CVE-2026-92619: Booking Calendar Privilege Escalation Flaw

CVE-2026-92619 Overview

CVE-2026-92619 is a privilege escalation vulnerability in the Booking Calendar plugin for WordPress affecting all versions up to and including 11.8.2. The flaw resides in the wpbc_ajax_option_save AJAX action, where the handle_ajax_save() function fails to enforce per-option safeguards on any option name not explicitly registered via register_option_policy(). Authenticated attackers with Editor-level access can overwrite arbitrary WordPress core options and elevate to Administrator.

Critical Impact
An authenticated Editor can set default_role=administrator and users_can_register=1, then self-register a new Administrator account, achieving full site takeover.

Affected Products

Booking Calendar plugin for WordPress — all versions ≤ 11.8.2
WordPress installations with Editor-or-above accounts exposed to untrusted users
Multisite deployments where the plugin is network-activated

Discovery Timeline

2026-09-18 - CVE-2026-92619 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-92619

Vulnerability Analysis

The vulnerability [CWE-269: Improper Privilege Management] stems from a broken allow-list in the plugin's option-save handler. The handle_ajax_save() function calls get_option_policy() to retrieve per-option safeguards including can_save, force_mode, and allowed_keys. When the requested option name is not registered via register_option_policy(), the function returns an empty policy rather than rejecting the request.

An attacker-controlled data_name POST parameter is passed through sanitize_key() and forwarded directly to update_option(). Because WordPress core options such as default_role and users_can_register are not registered with the plugin's policy layer, they receive no validation. The nonce check offers no meaningful protection: both the nonce value and nonce action are attacker-supplied, and a valid nonce is retrievable from admin-ajax.php?action=rest-nonce.

Root Cause

The plugin implements an implicit deny-by-registration model but fails to close the default path. Unregistered option names bypass every safeguard and reach update_option() unfiltered. The correct pattern would reject any option not explicitly allow-listed. See the Wordfence Vulnerability Report for full disclosure details.

Attack Vector

Exploitation requires an authenticated account at Editor level or above. The attacker fetches a valid REST nonce, submits a crafted POST to admin-ajax.php invoking wpbc_ajax_option_save with data_name=default_role and data_value=administrator, then repeats the request to enable users_can_register. The attacker then visits /wp-login.php?action=register and creates a new Administrator account. See the vulnerable AJAX handler and the option-save logic for the vulnerable code paths.

Detection Methods for CVE-2026-92619

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=wpbc_ajax_option_save and data_name values matching WordPress core options such as default_role, users_can_register, siteurl, or home.
Recently created user accounts with the administrator role that self-registered via /wp-login.php?action=register.
Unexpected changes to wp_options rows for default_role or users_can_register in database audit logs.

Detection Strategies

Monitor web server access logs for admin-ajax.php requests carrying the wpbc_ajax_option_save action combined with core-option names in the data_name parameter.
Alert on any modification to sensitive wp_options keys outside of routine administrative maintenance windows.
Correlate Editor-account activity with subsequent creation of new Administrator users within a short time window.

Monitoring Recommendations

Enable WordPress audit logging for user role changes, option updates, and new registrations.
Forward web and application logs to a centralized SIEM with alerting on the IOC patterns above.
Review authentication logs for Editor accounts followed by privileged actions from the same source IP.

How to Mitigate CVE-2026-92619

Immediate Actions Required

Update the Booking Calendar plugin to a version above 11.8.2 as soon as the vendor releases a patched release.
Audit all WordPress users for unauthorized Administrator accounts and remove any that cannot be attributed to legitimate activity.
Verify the current values of default_role and users_can_register in the database and restore expected settings.

Patch Information

The vendor addressed the issue in the plugin repository. Review the Booking Calendar changeset for the fix details and upgrade to the corresponding release.

Workarounds

Temporarily deactivate the Booking Calendar plugin until the patched version is deployed.
Restrict Editor-level accounts to trusted users only and rotate credentials for any shared accounts.
Set users_can_register to 0 and confirm default_role is subscriber at the database level, then monitor for tampering.
Deploy a web application firewall rule blocking admin-ajax.php requests with action=wpbc_ajax_option_save and data_name values matching WordPress core option keys.

bash

# Verify sensitive WordPress options via WP-CLI
wp option get default_role
wp option get users_can_register

# Enforce safe defaults
wp option update default_role subscriber
wp option update users_can_register 0

# List all Administrator accounts for audit
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered