CVE-2025-10124 Booking Manager < 2.1.15 - Contributor+ Booking Deletion
Contributors can delete bookings by visiting a page with a specific shortcode due to missing authorization checks in the Booking Manager plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-10124?
CVE-2025-10124 is a medium-severity missing authorization vulnerability in Unknown Booking Manager, published on 10 Oct 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted.
Which versions are affected by CVE-2025-10124?
How do I fix CVE-2025-10124?
No fix has been published for CVE-2025-10124 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-10124 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10124 exists.
Sources
Also known as GHSA-r6mg-vp4j-r6wc.