CVE-2026-91025: Unknown Booking Manager

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.

Affected products

• Unknown Booking Manager: before 2.1.21 (fixed in 2.1.21)

Published 2026-09-23. Last modified 2026-09-23.