The Booking Calendar Contact Form plugin for WordPress allows a user who has logged in with Subscriber-level permissions or higher to specify a calendar identifier in the dex_bccf_admin_int_calendar_list.inc.php file without proper validation. This insecure direct object reference flaw enables an attacker to view and potentially modify another user’s calendar data, resulting in a moderate breach of confidentiality and integrity.

The vulnerability affects all releases of the Booking Calendar Contact Form plugin up to and including version 1.2.63. Any WordPress site hosting this plugin at or below that version is at risk. Operators should confirm the installed plugin version via the WordPress admin interface and plan an upgrade.

The CVSS score of 5.3 indicates a moderate severity. An EPSS score of less than 1% suggests that active exploitation is unlikely currently, and the vulnerability is not cataloged in the CISA Known Exploited Vulnerabilities list, further reducing urgency. Exploitation requires authenticated access as a Subscriber or higher; the attacker can then supply a target calendar ID and gain unauthorized access to that calendar’s data. The combination of internal authentication and lack of ownership validation makes this attack straightforward for anyone with legitimate site credentials.