What is the CVSS score of CVE-2026-57778?

CVE-2026-57778 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

wpdevart Booking Calendar CVE-2026-57778

EUVD-2026-43396 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Booking Calendar Appointment Booking System Wordpress Plugin Wpdevart

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unguarded endpoint requires no credentials (PR:N) and no interaction; impact is write-only manipulation of booking data with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:20 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.

AnalysisAI

Missing authorization in the wpdevart Booking Calendar, Appointment Booking System WordPress plugin (versions through 3.2.36) permits unauthenticated remote attackers to bypass access controls and perform restricted booking-related actions, resulting in unauthorized data modification. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is trivially reachable over the network with no authentication, though impact is limited to integrity (I:L) with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) indicates the plugin fails to verify whether a requesting party has the right to perform a given action before executing it - a common class of broken access control in WordPress plugins where REST API endpoints or AJAX handlers omit capability checks (e.g., missing current_user_can() calls). The affected component is identified by CPE cpe:2.3:a:wpdevart:booking_calendar,_appointment_booking_system:*:*:*:*:*:*:*:* covering all releases up to and including 3.2.36. WordPress plugins in this category typically expose booking creation, modification, or administrative endpoints that, when improperly guarded, allow any network-accessible client to invoke privileged functionality without authentication.

RemediationAI

Upgrade the Booking Calendar, Appointment Booking System plugin beyond version 3.2.36; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/booking-calendar/vulnerability/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-36-broken-access-control-vulnerability should be consulted for the exact patched release version, as no specific fix version was confirmed in available data. If an immediate upgrade is not possible, a compensating control is to restrict access to the WordPress admin and AJAX endpoints (wp-admin/admin-ajax.php) using web application firewall rules that enforce authentication before processing booking-related requests - note this may break legitimate frontend booking functionality and require allowlisting authenticated sessions. Alternatively, temporarily deactivating the plugin eliminates the attack surface at the cost of losing booking functionality entirely.