CVE-2026-9851: masaakitanaka booking package

Vulnerability summary

CVE-2026-9851 is a high (CVSS 7.2) vulnerability in masaakitanaka booking package. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.3% of scored vulnerabilities. Fixed in 1.7.17.

Timeline

1. 06-06-2026
   PublishedVulnerability first disclosed.
2. 06-06-2026
   Last modifiedVulnerability information updated.

Description

The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.