EUVD-2026-68058
GHSA-8287-674v-3j6m
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Customers (low-privilege authenticated users) exploit this remotely with no complexity; PR:L reflects customer-role requirement, not high-privilege admin.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
AnalysisAI
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active WordPress customer account with at least one booking on the target site - unauthenticated visitors cannot exploit this flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS base score of 2.7 (PR:H) understates real-world risk for lower-privilege authenticated users, since the description clearly identifies ordinary 'customers' as the threat actor rather than high-privilege administrators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Booking for Appointments and Events Calendar WordPress plugin to version 2.4.9 or later, which introduces the required capability check before processing appointment status changes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions be
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allow
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 thr
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 thr
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today