Medium severity4.3NVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026
CVE-2026-91025
CVE-2026-91025
Description
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.1.21
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)Wordfence Blog · Oct 1, 2026