Booking Calendar < 11.9 - Unauthenticated Duplicate Slot Booking

Description

The Booking Calendar plugin for WordPress is vulnerable to Race Condition in all versions up to, and including, 11.8.4. This is due to missing real-time date-availability validation at the moment of date selection, allowing a date shown as available during calendar load to be selected and submitted after a concurrent booking had taken it. This makes it possible for unauthenticated attackers to make duplicate bookings for the same resource slot by exploiting the window between calendar availability display and actual booking submission.