WordPress Booking Calendar Plugin Unregistered Option Privilege Escalation

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassing all can_save, force_mode, and allowed_keys checks — for any unregistered option name, including core WordPress options, while an attacker-controlled `data_name` parameter passes through `sanitize_key()` and is written directly to `update_option()` without restriction. This makes it possible for authenticated attackers with Editor-level access and above to escalate their privileges to Administrator by writing core WordPress options such as `default_role=administrator` and `users_can_register=1`, then self-registering a new Administrator account. The nonce check does not meaningfully restrict

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Booking Calendar plugin for WordPress contains a privilege escalation vulnerability in versions up to 11.8.2 that allows authenticated attackers to modify unregistered options through the `wpbc_ajax_option_save` AJAX action. The flaw stems from incomplete input validation in the `handle_ajax_save()` function, which only applies security checks to explicitly registered options via `register_option_policy()`. Any unregistered option name bypasses all permission checks, force_mode restrictions, and allowed_keys validation, enabling attackers to escalate privileges or modify critical WordPress configurations. This affects any WordPress installation using the vulnerable Booking Calendar plugin, particularly those with user roles that should have limited permissions but can exploit this gap to gain unauthorized administrative capabilities.

Casky's 224 mapped skills leverage Claude AI with extended reasoning to detect the characteristic patterns of CWE-269 (Improper Access Control) attacks under MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify this attack through detection of AJAX requests to `wpbc_ajax_option_save` with option names absent from the plugin's registered policy registry, coupled with post-request changes to sensitive WordPress options like `siteurl`, `home`, or user capability modifications. The extended reasoning engine would correlate suspicious patterns such as low-privileged user accounts making direct option modifications, unexpected database changes to wp_options without corresponding API calls, and temporal clustering of AJAX requests targeting multiple unregistered options—collectively signaling an attempt to weaponize the validation gap for privilege escalation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92619.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-92619

Casky has 224 skills that investigate the attack patterns behind CVE-2026-92619. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn