What is the CVSS score of CVE-2026-6810?

CVE-2026-6810 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Booking Calendar Contact Form CVE-2026-6810

EUVD-2026-25401 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-24 Wordfence

GHSA-qfjv-r2q6-x287

PHP WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 06:00 euvd

EUVD-2026-25401

Analysis Generated

Apr 24, 2026 - 06:00 vuln.today

CVE Published

Apr 24, 2026 - 05:29 nvd

MEDIUM 5.3

DescriptionCVE.org

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user's calendars and view user data associated with the calendar.

AnalysisAI

Insecure Direct Object Reference in Booking Calendar Contact Form plugin for WordPress (all versions up to 1.2.63) allows authenticated attackers with Subscriber-level privileges to hijack other users' calendars and access associated user data by exploiting missing validation on user-controlled keys in the dex_bccf_admin_int_calendar_list.inc.php file. The CVSS score of 5.3 reflects network-accessible exploitation without user interaction, though the vulnerability requires valid WordPress authentication at Subscriber level or higher.

Technical ContextAI

The vulnerability is a classic Insecure Direct Object Reference (IDOR) flaw rooted in CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerable code in dex_bccf_admin_int_calendar_list.inc.php fails to validate that an authenticated user has permission to access a calendar object identified by a user-controlled parameter (likely a calendar ID). The plugin accepts this parameter without checking if the requesting user owns or has rights to that calendar, allowing any authenticated user to directly reference and manipulate calendars belonging to other users. This is a common PHP/WordPress plugin vulnerability pattern where object ownership is assumed rather than enforced. The affected CPE is cpe:2.3:a:codepeople:booking_calendar_contact_form, indicating the vulnerable component is the plugin itself developed by CodePeople.

RemediationAI

Update the Booking Calendar Contact Form plugin to a patched version released after 1.2.63. Consult the plugin's official WordPress repository page and the Wordfence threat intelligence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a3977d10-239d-4b83-ab0c-ad165485498d) for the specific fix version. If no patch is available, implement compensating controls: (1) restrict WordPress user registrations to trusted administrators only, ensuring only known admins can create accounts that might be exploited - this trades functionality for access control but is critical in multi-tenant scenarios; (2) use WordPress security plugins to monitor and log all calendar access events across the dex_bccf admin functions and alert on unusual cross-user access patterns; (3) implement database-level auditing to track who accesses which calendar IDs via this plugin's functions; (4) if the plugin is not actively used, disable or uninstall it entirely. These controls reduce exposure but do not eliminate the vulnerability, so patch deployment remains the primary remediation path.