What is the CVSS score of CVE-2026-27377?

CVE-2026-27377 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.3%.

QuickCal WordPress Plugin CVE-2026-27377

EUVD-2026-48154 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-r5c7-h5q4-cjrc

WordPress Authentication Bypass Wordpress Plugin Quickcal Appointment Booking Calendar For Wordpress Axiomthemes

6.7

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H

vuln.today AI

6.7 MEDIUM

Network-reachable WordPress AJAX/admin endpoint; PR:H reflects required Booking Agent role; C:H and A:H align with access to booking data and service disruption potential.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:02 vuln.today

CVE Published

Jul 23, 2026 - 11:17 cve.org

MEDIUM 6.7

DescriptionCVE.org

Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

AnalysisAI

Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.

Technical ContextAI

QuickCal is a WordPress appointment booking plugin developed by AxiomThemes (CPE: cpe:2.3:a:axiomthemes:quickcal_-_appointment_booking_calendar_for_wordpress:*:*:*:*:*:*:*:*). The root cause is CWE-862 Missing Authorization - the plugin defines a custom 'Booking Agent' role but fails to enforce proper capability or nonce checks on certain AJAX handlers or admin endpoints, allowing that role to invoke functionality reserved for higher-privileged roles. This is a common WordPress plugin pattern where custom roles are created without corresponding server-side authorization gates on each action, exposing the plugin's internal booking management API to over-privileged access by lower-tier authenticated users.

RemediationAI

The primary remediation is to update the QuickCal plugin beyond version 1.0.16; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quickcal/vulnerability/wordpress-quickcal-appointment-booking-calendar-for-wordpress-plugin-1-0-16-broken-access-control-vulnerability) and the WordPress plugin repository for the patched release version, which was not independently confirmed in the available data. If no patched version is yet available, administrators should audit all accounts holding the 'Booking Agent' role and reduce that user pool to only fully trusted individuals, as this directly limits the attack surface. Additionally, consider temporarily disabling the plugin on sensitive multi-tenant or customer-facing installations until a verified fix is applied. Patchstack's virtual patching feature (if licensed) can serve as a compensating control by blocking the malformed requests at the WAF layer without requiring a plugin update, though this introduces a dependency on Patchstack's ruleset accuracy.