Booking Calendar EUVD-2026-58839

No authentication is required - the CVSS vector confirms PR:N. The plugin must be installed and active on a WordPress site (any version through 3.2.36). The primary payment status manipulation and email dispatch vectors require no special site configuration and are exploitable against all affected installations. The auto-approval sub-vector additionally requires the WordPress site option 'enable_psuccess_approval' to be enabled by the site administrator; this is a non-default configuration setting, limiting that specific impact to a subset of deployments. The attacker must supply a valid reservation ID to target a specific booking, which may require prior enumeration of publicly accessible booking confirmation pages or identifiers. No user interaction, no elevated network position, and no special client software are required.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yields a base score of 5.3 (Medium), which accurately captures the low attack complexity and unauthenticated network accessibility but arguably underweights the business impact: fraudulent 'paid' status markings can cause an operator to render services without receiving payment, while cancellation of legitimate transactions directly disrupts revenue. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. The absence of a KEV listing and the lack of any known public exploit code suggest opportunistic mass exploitation has not been observed, though the low barrier (unauthenticated, no complexity, no user interaction) means this could change rapidly once a proof-of-concept circulates. The auto-approval sub-vector ('enable_psuccess_approval' site option) is conditionally exploitable, which reduces the fully-exploitable population, but the payment status manipulation and email dispatch vectors are unconditional and affect all installations. The integrity score of I:L may underrepresent operational risk for booking-dependent businesses even if the raw score appears moderate.

An attacker identifies a WordPress site running the Booking Calendar plugin by detecting the wpdevart plugin signature in page source or HTTP responses. The attacker then sends a crafted unauthenticated HTTP POST request targeting the payment status handler, supplying a forged transaction ID and a 'paid' or 'completed' status for a target reservation ID obtained by enumerating booking confirmation pages. The plugin writes the attacker-supplied data to the payments table without authorization checks, marks the reservation as paid, and dispatches a confirmation email to the customer - delivering service to the attacker without any financial transaction occurring.