CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.5 ) contains a missing capability check in one of its appointment-deletion functions . This allows users holding the plugin's low-privileged custom Staff role (or higher) to delete arbitrary appointments without p...