CVE-2026-6810CWE-639

Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover

Medium · published April 24, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user's calendars and view user data associated with the calendar.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-24T05:29Z
EPSS history
Timeline
  • 24 APR 05:29Z
    Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
    cvelistv5