QuickCal WordPress Plugin CVE-2026-27377

Exploitation requires an authenticated WordPress session with the plugin-defined 'Booking Agent' role (CVSS PR:H). The attacker must have network access to the WordPress admin or AJAX interface (AV:N). No user interaction from another party is required (UI:N). The WordPress installation must have the QuickCal plugin active and at version 1.0.16 or earlier. Exploitation is limited by the need for a valid Booking Agent credential - unauthenticated or subscriber-level users are not indicated as able to exploit this flaw based on the CVSS PR:H assignment. The practical risk is highest in environments with multiple booking agents, shared or reseller hosting with untrusted users, or where Booking Agent credentials could be phished or brute-forced.

The NVD-assigned CVSS 3.1 base score of 6.7 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H reflects a moderate-to-high concern tempered significantly by the PR:H (High Privileges) prerequisite. An attacker must already hold a Booking Agent account on the target WordPress installation, limiting opportunistic mass exploitation. No EPSS data was provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit is referenced, further reducing near-term real-world risk. Despite the High confidentiality and availability sub-scores - indicating potential access to customer appointment data and service disruption - the authenticated prerequisite means this is a realistic threat primarily in insider-threat, account-compromise, or multi-tenant hosting scenarios rather than unauthenticated mass exploitation. The PR:H assignment warrants verification: if 'Booking Agent' maps to a genuinely low-trust role (e.g., site subscriber with plugin-granted capabilities), the true exploitability may be higher than CVSS suggests.

An attacker who has obtained or registered a Booking Agent account on the target WordPress site sends crafted HTTP requests directly to restricted booking management endpoints or AJAX actions, bypassing the missing server-side authorization check. Because no complex prerequisites or user interaction are required beyond having the role, the attacker can enumerate and exfiltrate appointment records and customer PII, or delete/corrupt booking data to disrupt the business's scheduling operations. No public proof-of-concept is identified at time of analysis, but the straightforward nature of missing authorization flaws in WordPress plugins means the attack surface is easily discoverable through source code inspection.