What is the CVSS score of CVE-2026-18496?

CVE-2026-18496 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Booking Calendar CVE-2026-18496

EUVD-2026-96086 MEDIUM

Information Exposure (CWE-200)

2026-10-10 Wordfence

GHSA-865w-3pc6-gq4c

WordPress Information Disclosure Booking Calendar Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify site running Booking Calendar ≤11.4.3
Delivery

Send crafted unauthenticated request
Exploit

Trigger wpbc_is_show_popover_in_flex_timeline exposure
Execution

Harvest customer names, emails, phones
Impact

Use PII for phishing or fraud

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special configuration is required: the flaw is reachable against default installations of the Booking Calendar plugin (vendor wpdevelop) for any WordPress site running version 11.4.3 or earlier, by unauthenticated remote attackers (CVSS PR:N/UI:N). The only prerequisite is that the site has stored bookings containing customer PII (names, emails, phone numbers) for data to be exposed - a site with no bookings leaks nothing. Exploitation is LIMITED to confidentiality of booking data; there is no write, code-execution, or availability impact, and upgrading above 11.4.3 (the patched release per trac changeset 3633943) removes the exposure.
Impact	This is a moderate-severity information disclosure flaw whose signals are internally consistent but point to a limited-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, network-based, unauthenticated flaw with low attack complexity, which inflates attention, but the impact is scoped to confidentiality only (C:L/I:N/A:N) - no code execution, tampering, or availability loss. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active or imminent exploitation. The one capability signal that IS confirmed is that Wordfence (the reporting vendor) has published a threat-intel entry, and a WordPress.org trac changeset (3633943) confirms a fix was committed. Net assessment: a real but lower-tier issue - easy to exploit and privacy-relevant (PII leakage) rather than a system-compromise emergency. EPSS is unavailable, so probabilistic exploitation likelihood cannot be quantified from the data provided; treat the 5.3 score as the primary prioritization anchor.
Exploit ScenarioDerived	An unauthenticated attacker sends crafted HTTP requests to a WordPress site running Booking Calendar ≤11.4.3, invoking the exposed wpbc_is_show_popover_in_flex_timeline() code path to retrieve booking records. The response leaks customer PII - names, email addresses, and phone numbers - enabling downstream phishing or fraud. No public proof-of-concept exploit is referenced in the provided data.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 10, 2026

Sensitive customer records - booking names, email addresses, and phone numbers - can be pulled without authentication from any WordPress site running the Booking Calendar plugin through version 11.4.3, because the wpbc_is_show_popover_in_flex_timeline() function returns booking data without an authorization check. The flaw is reachable against default installations over the network with no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 5.3 Medium), and its only prerequisite is that the site already holds bookings containing PII; sites with no bookings leak nothing. Impact is confined to confidentiality (C:L) with no write, code-execution, or availability effect, no public exploit code and no confirmed active exploitation were identified at time of analysis, and upgrading beyond 11.4.3 removes the exposure.

RemediationAI

Primary fix: update the Booking Calendar plugin past 11.4.3 - the release boundary identified in our assessment - using the update delivered through the WordPress.org plugin repository; the underlying code fix is the upstream Trac changeset https://plugins.trac.wordpress.org/changeset/3633943/booking, so any build carrying that change is remediated (the changeset is a commit-level fix and a specific tagged patched version number is not independently confirmed here, so verify the installed version number in wp-admin after updating). If updating immediately is not possible, compensating controls in order of reliability are: deactivate the Booking Calendar plugin entirely, which eliminates the exposure at the cost of losing the booking/calendar functionality and front-end booking forms; or, if the plugin must stay live, restrict the affected timeline/popover view to authenticated administrators only (for example by hiding or removing the flex-timeline shortcode from public pages and templates), accepting that public visitors lose that view; or, at the WAF/reverse-proxy layer, block anonymous requests that invoke the popover/timeline path of the plugin, recognising that this is signature-dependent, can be bypassed by parameter variation, and may break legitimate calendar rendering. Because exploitation is read-only, a patch does not require credential rotation for integrity reasons, but any site that ran an affected version should treat booking PII (names, emails, phone numbers) as potentially harvested, review access logs for repeated anonymous hits on the plugin endpoints, and notify affected customers where required by privacy regulation such as GDPR. Vendor advisory and technical detail: https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebfb030-c9b7-477a-8fe3-78e97da6bea9?source=cve.

Affected VersionsENISA

Booking Calendar 0 ≤11.4.3

Affected Packages

euvd booking_calendar no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The target is a commercial WordPress plugin (vendor wpdevelop, CPE cpe:2.3:a:wpdevelop:booking_calendar:*:*:*:*:*:*:*:*) whose affected code lives in the plugin's popover/flex-timeline rendering logic. The root cause class is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor: the function wpbc_is_show_popover_in_flex_timeline() is used to decide whether booking details are surfaced in a popover in the flexible timeline view, and the data-returning path does not verify that the requester is an authenticated administrator or the booking owner before emitting record fields. Because WordPress exposes many plugin entry points to anonymous visitors - for example handlers registered through admin-ajax.php with the wp_ajax_nopriv_ prefix, public shortcodes, or template-level hooks - logic that assumes a privileged viewing context can be triggered directly by an unauthenticated network request. The assessed vector (PR:N, UI:N) confirms the vulnerable code path needs no credentials and no victim interaction, and AC:L indicates no unusual race, configuration, or memory-layout precondition. Exploitation yields read-only disclosure of the booking table's PII columns (customer name, email, phone) and cannot modify records, execute code, or degrade availability, which is why the CVSS impact is limited to C:L. The Trac changeset referenced by the vendor advisory (changeset 3633943) is the upstream code change that closes this path.

Know when Booking Calendar gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 5.3 MEDIUM

Unauthenticated network request with low complexity (AV:N/AC:L/PR:N/UI:N); only limited confidentiality of booking PII is affected, so C:L and I/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Medium

popular WordPress booking plugin, widely installed but not universal

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.