Booking Calendar EUVD-2026-60801

No special conditions are required beyond the Booking Calendar plugin being installed, active, and accessible on a publicly reachable WordPress site. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms fully unauthenticated, network-based exploitation with no user interaction. Exploitation is limited to integrity and availability impacts on booking and appointment records; no confidentiality impact (C:N) is indicated, meaning attacker cannot read other users' personal data through this vector alone. The primary limiting factor is attack impact scope: damage is confined to scheduling data within the plugin's database tables and does not affect WordPress core or other plugins. Sites that additionally restrict booking endpoints to authenticated users via separate access controls (e.g., members-only pages, additional authentication middleware) may reduce exposure, but this depends on whether the underlying plugin API endpoints enforce those restrictions independently.

The CVSS 6.5 base score reflects a medium-severity finding with network accessibility, no privilege requirement, and no user interaction - characteristics that make exploitation straightforward and automatable. Impact is bounded to low integrity and low availability (C:N/I:L/A:L), meaning an attacker cannot extract sensitive personal data but can disrupt or falsify scheduling records. No EPSS score, KEV listing, or POC reference was provided in the available intelligence; real-world exploitation risk is therefore inferred from CVSS signals rather than confirmed by observed activity. The automatable nature of IDOR enumeration (incrementing or decrementing integer booking IDs) means a single attacker script could target all bookings across an entire installation. For businesses in verticals where appointment integrity is critical - medical, legal, hospitality - the business impact of mass booking disruption significantly exceeds the raw CVSS score. SSVC assessment: exploitation unconfirmed, automatable: yes, technical impact: partial.

An unauthenticated attacker visits a target WordPress site running this plugin and completes a test booking to observe a valid appointment object ID returned in the response or URL. By iterating that ID across subsequent unauthenticated requests to the booking modification or cancellation endpoint, the attacker overwrites or deletes appointments belonging to other users at scale. No public exploit code has been identified at time of analysis, but the attack requires only basic HTTP request manipulation.