CVE-2026-9851: Booking Package Account Takeover via updateUser (CVSS 7.2)

CVE-2026-9851 is a CVSS 7.2 privilege escalation in the Booking Package WordPress plugin. Editor+ users can take over any admin account via updateUser action.