CVE-2026-2230: medium-severity vulnerability in wpdevelop Booking Calendar
Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.2%
The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, and booking permissions granted by an Administrator, to modify other users' plugin settings, such as booking calendar display options, which can disrupt the booking calendar functionality for the targeted user.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
wpdevelop · Booking CalendarRelated CVEs — wpdevelop Booking Calendar
In the same product, most dangerous first.
CVE-2024-1207CRITICALBooking Calendar <= 9.9 - Unauthenticated SQL InjectionEPSS 3.2%CVE-2017-2150—CVE-2017-2150EPSS 2.4%CVE-2022-1463HIGHBooking Calendar <= 9.1 - PHP Object Injection via ShortcodeEPSS 1.7%CVE-2017-2151—CVE-2017-2151EPSS 0.9%CVE-2026-92619HIGHBooking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' ParameterEPSS 0.7%CVE-2024-8274MEDIUMWP Booking Calendar <= 10.5 - Reflected Cross-Site ScriptingEPSS 0.5%