Booking Manager, CVE-2025-10124

CVE, Research URL: CVE-2025-10124
Home page URL: Security reports for Booking Manager
Application: Booking Manager
Published on: Oct 10, 2025
Research Description: The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.
Affected versions: max 2.1.15.
Status: vulnerable