EUVD-2026-60801
GHSA-wrj4-qvh9-mx4r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible WordPress endpoint requiring no authentication; impact confined to booking data integrity and availability with no confidentiality exposure.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
AnalysisAI
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Booking System WordPress plugin (versions ≤ 3.2.36) by substituting predictable booking object identifiers in unauthenticated requests - a classic CWE-639 authorization bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication and no user interaction are required, making this trivially automatable against all exposed WordPress installations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the Booking Calendar plugin being installed, active, and accessible on a publicly reachable WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 base score reflects a medium-severity finding with network accessibility, no privilege requirement, and no user interaction - characteristics that make exploitation straightforward and automatable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker visits a target WordPress site running this plugin and completes a test booking to observe a valid appointment object ID returned in the response or URL. By iterating that ID across subsequent unauthenticated requests to the booking modification or cancellation endpoint, the attacker overwrites or deletes appointments belonging to other users at scale. … |
| Remediation | No specific patched version number was confirmed in the available data - administrators should check the WordPress plugin repository for a release above 3.2.36 and apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the wpdevart Booking Calendar and Appointment Booking System
Authorization bypass in the wpdevart Booking Calendar, Appointment Booking System plugin for WordPress (all versions thr
Missing authorization in the wpdevart Booking Calendar, Appointment Booking System WordPress plugin (versions through 3.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today