{"id":"CVE-2026-105195","aliases":["EUVD-2026-94767","GHSA-2c7f-rp38-5cq9"],"status":"published","title":"Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure","description":"The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0023,"percentile":0.13936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-10-08T06:00:06Z","modified":"2026-10-08T20:51:18Z","products":[{"vendor":"unknown","product":"booking calendar"},{"vendor":"wpdevelop","product":"booking calendar"}],"references":[{"url":"https://wpscan.com/vulnerability/9d6e9047-410e-4d3d-81f0-e3f89cf7a494/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105195"},{"url":"https://wpscan.com/vulnerability/9d6e9047-410e-4d3d-81f0-e3f89cf7a494"},{"url":"https://github.com/advisories/GHSA-2c7f-rp38-5cq9"}],"sources":{"cve":[{"id":"CVE-2026-105195","title":"Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure","description":"The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.","status":"published","published":"2026-10-08T06:00:06.908Z","modified":"2026-10-08T10:59:19.025Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-94767","description":"The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.","status":"published","published":"2026-10-08T06:00:06Z","modified":"2026-10-08T10:59:19Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:33.098422Z"}],"ghsa":[{"id":"GHSA-2c7f-rp38-5cq9","title":"The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a...","description":"The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.","status":"published","published":"2026-10-08T06:31:19Z","modified":"2026-10-08T12:34:24Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:12:56.476072Z"}],"nvd":[{"id":"CVE-2026-105195","description":"The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.","status":"published","published":"2026-10-08T06:16:40.01Z","modified":"2026-10-08T20:51:18.123Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:55.142936Z"}]}}