wpdevart Booking Calendar CVE-2026-57778

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms no special conditions are required beyond network access to a WordPress installation running the Booking Calendar, Appointment Booking System plugin in versions up to and including 3.2.36. No authentication is needed, no user interaction is required, and no non-default configuration must be present. Exploitation is limited to the integrity dimension - attackers cannot read protected data (C:N) or crash the service (A:N). The limiting factors are: the targeted site must have this specific plugin installed and activated, and the attacker must correctly identify the unprotected endpoint path.

The NVD-assigned CVSS 5.3 (Medium) reflects a network-accessible, low-complexity, unauthenticated attack path - signals that lower the exploitation barrier significantly. However, the impact is bounded: only integrity is affected (I:L), with no confidentiality or availability loss, suggesting the attacker can manipulate booking records but cannot read sensitive data or disrupt service. No EPSS data was provided, and neither a CISA KEV listing nor a published POC has been identified, placing real-world exploitation risk in the speculative range at this time. The 'Authentication Bypass' tag aligns with the PR:N metric and confirms no credential requirement. The primary risk driver is the large attack surface of internet-exposed WordPress installations running this plugin - a low-skill actor scanning for unpatched endpoints could automate exploitation. This is a genuine medium-priority issue for any site running the plugin, particularly those where unauthorized booking manipulation could cause business disruption, but it is not a critical emergency absent active exploitation evidence.

An unauthenticated attacker enumerates a target WordPress site running plugin version 3.2.36 or earlier and identifies an unprotected booking endpoint - a REST route or admin-ajax action - that lacks a capability check. The attacker sends a crafted HTTP POST request directly to that endpoint, bypassing access control to create, modify, or delete booking records without any credentials.