CVE-2026-9851

The flaw

The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJA

What to do

Review advisory and patch per vendor guidance.

References