CVE-2026-57778
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Booking calendar, Appointment Booking System plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.36.
Risk Assessment
An attacker can gain unauthorized access to calendar and booking system functions, potentially modifying or stealing booking data and disrupting system operations.
Recommendation
Immediately update the Booking calendar, Appointment Booking System plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Booking calendar, Appointment Booking System
See all- CVE-2026-73395Medium
The Booking calendar, Appointment Booking System plugin version 3.2.36 and earlier has an insecure direct object references (IDOR) vulnerability that does not require authentication. This means an unauthenticated attacker can access objects (e.g., bookings) without authorization.
- CVE-2026-8840Medium
The Booking calendar, Appointment Booking System plugin for WordPress up to version 3.2.36 has an authorization bypass vulnerability. Unauthenticated attackers can mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional emails.
Original NVD description (English source)
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.