⚠️ CVE-2026-9851 (HIGH): masaakitanaka Booking Package plugin for WordPress lets Editors escalate to Admin via AJAX endpoint, risking full site takeover. Restrict Editor access & monitor for updates. More: https://radar.offseq.com/threat/cve-2026-9851-cwe-639-authorization-bypass-through-49f29652 #OffSeq #WordPress #Security #Vuln