The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in…

CVE-2026-9851 is an authenticated privilege-escalation flaw in the Booking Package WordPress plugin affecting versions up to and including 1.7.16, fixed in 1.7.17. Public writeups describe abuse of the plugin's updateUser AJAX action to take over another account, including an administrator account, which turns a lower-privileged logged-in user into full site control.

The vendor's HIGH 7.2 score is technically defensible for impact, but it overstates enterprise urgency because the hardest part of the attack is not the AJAX request — it is already having a valid Editor+ session on the target WordPress site. That makes this a post-auth, post-access flaw with a much narrower exposed population than an internet-reachable unauthenticated WordPress bug, so it lands better as MEDIUM for patch-priority planning.

Why this verdict

• Down from 7.2 because PR:H is not decorative — this requires an authenticated Editor+ foothold, which implies the attacker already compromised an account or insider workflow before the CVE even becomes usable.
• Down again because exposure is narrower than raw WordPress counts imply — only sites running Booking Package <= 1.7.16 and granting suitable roles to non-admin users are plausibly exploitable.
• Held above LOW because successful exploitation is a full control event — if the attacker can hijack an administrator, the blast radius is the entire WordPress application, including plugins, content, secrets, and possible server-side follow-on abuse.

Why not higher?

This is not an unauthenticated front-door bug, and it is not a generic subscriber-level escalation with trivial abuse paths across the public internet. Requiring Editor+ on the same tenant collapses the reachable population and pushes the flaw firmly into post-compromise amplification, which is why it does not deserve a HIGH or CRITICAL patch queue slot absent fresh exploitation evidence.

Why not lower?

Once the prerequisite is met, the impact is severe: administrator takeover is effectively application compromise. Also, WordPress sites often have weak operational boundaries between content editors, booking staff, and site admins, so this is not purely theoretical privilege trivia.

1. Restrict Editor-class accounts — Audit who actually has Editor or higher on affected sites and remove excess privileges now; this is the most direct way to cut the exploit chain at its first required step. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this control is cheap and should be folded into normal access hygiene immediately.
2. Alert on privileged account changes — Create detections for unexpected password resets, email changes, and capability changes affecting administrator accounts, especially when initiated through admin-ajax.php or by non-admin sessions. Even without a formal noisgate mitigation deadline for MEDIUM, this sharply reduces dwell time if someone abuses the flaw before patching.
3. Enforce MFA for administrators — If the takeover path results in changed credentials but the admin account still requires MFA, you may stop clean login completion or at least force the attacker into noisier recovery paths. This is a strong containment layer while you work through the remediation window.
4. Constrain WordPress admin surface — Put /wp-admin/ and high-risk AJAX/admin functions behind VPN, IdP access policy, IP allowlisting, or reverse-proxy controls where operationally feasible. This does not fix the bug, but it reduces who can exercise an already-authenticated session against the vulnerable path.

Run this on the target WordPress host or from a management shell with read access to the site's filesystem. Invoke it as bash check-booking-package-cve-2026-9851.sh /var/www/html and it needs only enough privilege to read wp-content/plugins/booking-package; root is not required.

#!/usr/bin/env bash
# check-booking-package-cve-2026-9851.sh
# Detect vulnerable versions of the Booking Package WordPress plugin.
# Usage: bash check-booking-package-cve-2026-9851.sh /path/to/wordpress
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / not installed / cannot determine

set -u

WP_ROOT="${1:-}"
if [ -z "$WP_ROOT" ]; then
  echo "UNKNOWN - usage: $0 /path/to/wordpress"
  exit 2
fi

PLUGIN_DIR="$WP_ROOT/wp-content/plugins/booking-package"
if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN - Booking Package plugin directory not found: $PLUGIN_DIR"
  exit 2
fi

version=""

# Try common plugin header files first
for f in "$PLUGIN_DIR/booking-package.php" "$PLUGIN_DIR/index.php"; do
  if [ -r "$f" ]; then
    v=$(grep -Eim1 '^\s*Version:\s*' "$f" | sed -E 's/^\s*Version:\s*//I' | tr -d '\r')
    if [ -n "$v" ]; then
      version="$v"
      break
    fi
  fi
done

# Fall back to readme.txt Stable tag
if [ -z "$version" ] && [ -r "$PLUGIN_DIR/readme.txt" ]; then
  v=$(grep -Eim1 '^\s*Stable tag:\s*' "$PLUGIN_DIR/readme.txt" | sed -E 's/^\s*Stable tag:\s*//I' | tr -d '\r')
  if [ -n "$v" ]; then
    version="$v"
  fi
fi

if [ -z "$version" ]; then
  echo "UNKNOWN - could not determine installed Booking Package version"
  exit 2
fi

normalize() {
  local IFS=.
  local parts=($1)
  printf '%d %d %d\n' "${parts[0]:-0}" "${parts[1]:-0}" "${parts[2]:-0}"
}

ver_lte() {
  local a b c x y z
  read -r a b c <<< "$(normalize "$1")"
  read -r x y z <<< "$(normalize "$2")"
  if [ "$a" -lt "$x" ]; then return 0; fi
  if [ "$a" -gt "$x" ]; then return 1; fi
  if [ "$b" -lt "$y" ]; then return 0; fi
  if [ "$b" -gt "$y" ]; then return 1; fi
  if [ "$c" -le "$z" ]; then return 0; fi
  return 1
}

if ver_lte "$version" "1.7.16"; then
  echo "VULNERABLE - Booking Package version $version (affected: <= 1.7.16)"
  exit 1
else
  echo "PATCHED - Booking Package version $version (fixed: >= 1.7.17)"
  exit 0
fi

Sources

1. WordPress.org plugin page and changelog for Booking Package
2. WPScan Booking Package vulnerability listing
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS overview
5. FIRST EPSS FAQ
6. VulDB entry for CVE-2026-9851
7. Wordfence historical Booking Package updateUser authorization flaw