Privilege Escalation via Account Takeover in Booking Package WordPress Plugin

CVE-2026-9851 affects the Booking Package plugin for WordPress in versions up to and including 1.7.16. The flaw is in the 'updateUser' branch of the package_app_action AJAX endpoint. The handler validates only a nonce and does not perform a capability check to ensure the caller is authorized to modify the targeted account. The dispatcher then invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, which bypasses the owner-restriction logic inside that function. As a result, the target user is selected entirely from attacker-controlled input that is passed directly to wp_update_user(). This allows an authenticated attacker with Editor-level privileges or higher to modify arbitrary user accounts, including changing the email address and password of Administrator accounts.