WordPress Booking Calendar Plugin Missing Capability Check Lets Subscribers Delete Notes

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function.

This affects versions up to and including 2.1.0.5.

• Authenticated attackers with Subscriber-level access and above can delete arbitrary calendar notes belonging to any calendar.