CVE-2026-1431

Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure

View on CVE.org
Published Jan 31, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.

Analysis

AI-generated

Technical impact

The Booking Calendar plugin for WordPress permits unauthenticated users to invoke an AJAX function that reveals detailed booking information, including customer names, phone numbers, and email addresses, because the function lacks a capability check. This missing authorization check leads to a confidentiality breach and corresponds to CWE‑862.

Affected Systems

WordPress sites running the wpdevelop:Booking Calendar plugin, versions up to and including 10.14.13, are affected.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3 and an EPSS score of less than 1 %, indicating moderate severity but a low likelihood of exploitation. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is an unauthenticated AJAX request; attackers only need access to the site’s public URL to retrieve sensitive booking data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Booking Calendar plugin to the latest available version to add the missing capability check.
  • If an update is unavailable, disable or delete the plugin to eliminate the exposure.
  • Configure web‑application firewalls or server rules to block unauthenticated access to the wpbc‑ajax.php endpoint, or further restrict it to authenticated users only.

Generated by OpenCVE AI on April 16, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpdevelop
Wpdevelop booking Calendar
Vendors & Products Wordpress
Wordpress wordpress
Wpdevelop
Wpdevelop booking Calendar
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.
Title Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 4:34 PM
Reserved
Jan 26, 2026, 10:49 AM

View source JSON

Updated
Feb 2, 2026, 5:58 PM

JSON

Status
Deferred
Published
Jan 31, 2026, 5:16 AM
Modified
Jun 17, 2026, 10:15 AM

View source JSON

No data.

Updated
Apr 16, 2026, 1:30 AM

JSON