Booking Calendar Contact Form CVE-2026-6810

Authentication requirement: The attacker must have valid WordPress user credentials at Subscriber level or higher. A Subscriber account can be created via open registration (if enabled on the target site) or obtained through credential compromise. No special plugin configuration is required - the vulnerability exists in all versions up to 1.2.63 by default. The vulnerable dex_bccf_admin_int_calendar_list.inc.php file must be accessible (standard WordPress plugin file structure). The attacker must know or guess a target calendar ID, though sequential or brute-force enumeration is feasible. No user interaction is required beyond the attacker's own account actions.

The risk profile is moderate but conflicted. CVSS 5.3 with AV:N/AC:L/PR:N/UI:N suggests a readily exploitable network vulnerability, but this conflicts with the description stating attackers need Subscriber-level access (PR:N in vector typically means unauthenticated). The CVSS vector likely represents the requirement to reach the vulnerable endpoint (network-accessible) with low attack complexity, while the PR:N may be a classification artifact. The realistic attack requires: (1) a valid WordPress user account at minimum Subscriber level, (2) knowledge or enumeration of target calendar IDs, and (3) access to an active WordPress installation. This significantly narrows the threat landscape compared to unauthenticated exploitation. No EPSS score, KEV status, or POC availability was provided, so active exploitation cannot be confirmed. However, IDOR vulnerabilities are trivial to exploit once discovered and often automated by attackers. The integrity impact (I:L) and confidentiality exposure to user data make this a legitimate priority for WordPress administrators with multi-user environments, but organizations with single-admin or tightly controlled user bases face lower real-world risk. The lack of confirmed patches in available data adds urgency.

An attacker creates a low-privileged WordPress Subscriber account or gains credentials for an existing Subscriber. They enumerate calendar IDs by accessing their own calendar or attempting sequential numeric IDs. Using the dex_bccf_admin_int_calendar_list.inc.php endpoint, they submit requests with calendar IDs belonging to other users. The plugin fails to validate ownership and returns or allows modification of the target calendar, exposing booking data, contact information, and associated user profiles of the calendar's legitimate owner.