Medium severity4.5NVD Advisory· Published Oct 10, 2025· Updated Apr 15, 2026

CVE-2025-10124

Description

The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Booking Managerinferred2 versions
<2.1.15+ 1 more
- (no CPE)range: <2.1.15
- (no CPE)range: <2.1.15
Package: https://wordpress.org/plugins/booking-manager

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/9bb0589f-34bb-40e1-b7f0-ee883b7b896c/nvd

News mentions

No linked articles in our index yet.

cvss	0.293
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000