LOW 2.7 NVD

CVE-2026-105195

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings hand

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.

References

https://wpscan.com/vulnerability/9d6e9047-410e-4d3d-81f0-e3f89cf7a494/

Published: 2026-10-08 · Source: NVD · Feed updated: 2026-10-12

This low severity vulnerability with a CVSS score of 2.7 was published on 2026-10-08 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.