Description
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.
Published: 2026-10-02
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Race Condition
Action: Assess Impact
AI Analysis

Impact

The vulnerability is a race condition caused by improper synchronization of a shared resource within the WordPress Booking Calendar plugin. Concurrent execution of booking operations can result in unpredictable behavior, potentially allowing an attacker to manipulate booking data or bypass expected validation checks. This weakness is identified as CWE-362 and indicates that the plugin does not correctly handle simultaneous requests.

Affected Systems

The affected product is the WordPress Booking Calendar plugin by WPdevelop, versions from the earliest releases up through 11.8.4. Any WordPress site deploying this plugin under those versions is susceptible.

Risk and Exploitability

The CVSS base score of 3.7 classifies the issue as low severity, and the EPSS score is not available, suggesting uncertainty about exploitation frequency. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to orchestrate multiple rapid requests to the booking functionality, likely via a web front‑end, to trigger the race condition. No public exploit has been documented, and the issue is still classified as low impact despite the potential for data integrity problems.

Generated by OpenCVE AI on October 2, 2026 at 16:38 UTC.

Remediation

Vendor Solution

Update the WordPress Booking Calendar plugin to the latest available version (at least 11.9).

OpenCVE Recommended Actions

  • Update the Booking Calendar plugin to version 11.8.5 or later, which contains the synchronization fix.
  • Limit or throttling concurrent booking requests by enabling WordPress maintenance mode or using a rate‑limiting plugin to reduce the chance of race conditions.
  • Review and harden the plugin configuration, ensuring that booking operations are serialized or that the shared resource is properly protected.

Generated by OpenCVE AI on October 2, 2026 at 16:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions booking Calendar
Wpdevelop
Wpdevelop booking Calendar
Vendors & Products Wordpress-extensions
Wordpress-extensions booking Calendar
Wpdevelop
Wpdevelop booking Calendar

Sat, 03 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.
Title WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability
Weaknesses CWE-362
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress-extensions Booking Calendar
Wpdevelop Booking Calendar
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-05T07:01:17.773Z

Reserved: 2026-04-07T10:48:50.116Z

Link: CVE-2026-39601

cve-icon Vulnrichment

Updated: 2026-10-03T15:11:24.126Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T15:17:09.907

Modified: 2026-10-05T08:17:15.983

Link: CVE-2026-39601

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T09:09:12Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')