What is the CVSS score of CVE-2026-74002?

CVE-2026-74002 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Booking Calendar CVE-2026-74002

EUVD-2026-81515 MEDIUM

Missing Authorization (CWE-862)

2026-09-17 Patchstack

GHSA-p448-cmrg-c3wh

PHP WordPress Authentication Bypass Booking Calendar Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network endpoint with missing authorization check (PR:N/AC:L), no user interaction; impact limited to low integrity from unauthorized actions, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 17, 2026 - 15:40 vuln.today

tag: PHP added

Analysis Generated

Sep 17, 2026 - 14:40 vuln.today

CVE Published

Sep 17, 2026 - 13:24 cve.org

MEDIUM 5.3

DescriptionCVE.org

Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.

AnalysisAI

Unauthenticated broken access control in the WordPress plugin Booking Calendar (wpdevelop) at version 11.7 and earlier lets remote attackers invoke booking-related functionality that should require authorization, with no credentials and no user interaction required. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), impact is limited to low integrity - unauthorized actions or manipulation within the plugin's booking data - with no confidentiality or availability effect, so this is a genuine but modest-priority issue. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a WordPress site running the Booking Calendar plugin (by wpdevelop) at version 11.7 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but modest-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch status: no vendor-released patch version is identified in the available intelligence, so treat the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/booking/vulnerability/wordpress-booking-calendar-plugin-11-7-broken-access-control-vulnerability) as the authoritative source and upgrade Booking Calendar to the first fixed release above 11.7 as soon as the vendor publishes it; do not rely on an assumed version number. … Detailed patch versions, workarounds, and compensating controls in full report.