CVE-2025-67574
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Booking calendar, Appointment Booking System plugin (by wpdevart) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Booking calendar, Appointment Booking System from n/a through <= 3.2.30.
Risk Assessment
The risk is that unauthorized users may gain access to functions or data that should be protected, which could lead to a breach of confidentiality or integrity of the system.
Recommendation
It is recommended to update the Booking calendar, Appointment Booking System plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Booking calendar, Appointment Booking System
See all- CVE-2026-73395Medium
The Booking calendar, Appointment Booking System plugin version 3.2.36 and earlier has an insecure direct object references (IDOR) vulnerability that does not require authentication. This means an unauthenticated attacker can access objects (e.g., bookings) without authorization.
- CVE-2026-8840Medium
The Booking calendar, Appointment Booking System plugin for WordPress up to version 3.2.36 has an authorization bypass vulnerability. Unauthenticated attackers can mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional emails.
- CVE-2026-57778Medium
The Booking calendar, Appointment Booking System plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.36.
Original NVD description (English source)
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.30.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS