WordPress Plugin Vulnerabilities

Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Insecure Direct Object Reference

Description

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.36. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
booking-calendar
No known fix

References

CVE
CVE-2026-73395
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2553b9-775a-48f4-a7fd-1b885511bfa9

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Jakub Herman
Verified
No
WPVDB ID
4884ae1c-a839-4335-87f0-c13f85383aff

Timeline

Publicly Published
2026-08-18 (about 1 month ago)
Added
2026-08-24 (about 27 days ago)
Last Updated
2026-08-24 (about 27 days ago)

Other

Published
Title
Published
2026-01-02
Title
Roam <= 2.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-01-16
Title
Frontend File Manager Plugin < 23.6 - Unauthenticated Insecure Direct Object Reference
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference via 'quantity'
Published
2026-02-10
Title
Download Attachments < 1.4.1 - Unauthenticated Insecure Direct Object Reference
Published
2026-02-11
Title
Cnvrse < 026.02.10.20 - Unauthenticated Insecure Direct Object Reference