vcita Booking Calendar EUVD-2026-85488

Exploitable against WordPress sites running the Online Booking & Scheduling Calendar for WordPress by vcita plugin (slug meeting-scheduler-by-vcita) at version 4.6.0 or earlier. Per the CVSS vector the attack is remote and requires no authentication, no privileges, and no user interaction (AV:N/PR:N/UI:N), so no special account or configuration is needed beyond having the vulnerable plugin installed and active. The practical limiter is that the advisory does not name the affected endpoint or action, so the exact request needed is not yet public; impact is confined to integrity (data/settings modification) with no stated confidentiality or availability effect.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an attractive profile - remote, low-complexity, unauthenticated, no user interaction - with a single high impact on integrity (C:N/I:H/A:N), consistent with CWE-862 Missing Authorization where an attacker reaches a protected function that mutates state without any confidentiality or availability effect. That yields the reported 7.5 base score, which is accurate for the vector given. However, the real-world priority signals are weaker than the base score suggests: there is no EPSS probability, no CISA KEV listing, and no public proof-of-concept in the provided data, and Patchstack's advisory is the sole source with only a brief description and no named endpoint or exploitation detail. No SSVC decision-framework data was supplied. The score therefore rests almost entirely on the CVSS integrity assumption; if the affected action is low-value (e.g., non-sensitive booking metadata) the practical impact is lower than 'I:H' implies. Net: a credible but unverified unauthenticated write flaw that merits patching, not an active-exploitation emergency - treat as medium priority pending confirmation of the specific vulnerable function.

An unauthenticated attacker sends a crafted request directly to a plugin action or REST/AJAX endpoint that lacks a capability/authorization check, allowing them to create, alter, or delete booking data or plugin configuration without logging in. No proof-of-concept is public and no active exploitation is reported; the low attack complexity (AC:L) means that once the endpoint is identified, exploitation is straightforward and repeatable.