EUVD-2026-69869
GHSA-rq3j-2rhf-wgw8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-reachable with no auth or interaction required; impact limited to notification/callback triggering with no confidentiality exposure, matching provided vector.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.
AnalysisAI
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allows unauthenticated remote attackers to trigger the post-booking action chain - including email notifications and third-party integration callbacks - for any booking by guessing or enumerating its numeric identifier. The plugin fails to validate either session authentication or a nonce/request token before executing post-booking hooks, meaning an attacker can impersonate the completion of any booking without ever making a real reservation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication, no valid nonce, and no special configuration are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) appropriately reflects a network-accessible, zero-authentication flaw with limited but real impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Booking for Appointments and Events Calendar WordPress plugin to version 2.4.9 or later, which introduces the missing authorization and nonce validation on the post-booking action endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions be
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 thr
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 thr
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allo
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today