CVE-2026-1431: falha de média gravidade em wpdevelop Booking Calendar
Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
wpdevelop · Booking CalendarCVEs relacionadas — wpdevelop Booking Calendar
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1207CRITICALBooking Calendar <= 9.9 - Unauthenticated SQL InjectionEPSS 3.2%CVE-2017-2150—CVE-2017-2150EPSS 2.4%CVE-2022-1463HIGHBooking Calendar <= 9.1 - PHP Object Injection via ShortcodeEPSS 1.7%CVE-2017-2151—CVE-2017-2151EPSS 0.9%CVE-2026-92619HIGHBooking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' ParameterEPSS 0.7%CVE-2024-8274MEDIUMWP Booking Calendar <= 10.5 - Reflected Cross-Site ScriptingEPSS 0.5%