CVE-2026-1431CWE-862

Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure

Medium · published January 31, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-31T04:35Z
EPSS history
Timeline
  • 31 JAN 04:35Z
    Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
    cvelistv5