CVE-2026-73395
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Booking calendar, Appointment Booking System plugin version 3.2.36 and earlier has an insecure direct object references (IDOR) vulnerability that does not require authentication. This means an unauthenticated attacker can access objects (e.g., bookings) without authorization.
Risk Assessment
The risk is that an attacker can access sensitive data or resources, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to update the plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Booking calendar, Appointment Booking System
See all- CVE-2026-8840Medium
The Booking calendar, Appointment Booking System plugin for WordPress up to version 3.2.36 has an authorization bypass vulnerability. Unauthenticated attackers can mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional emails.
- CVE-2026-57778Medium
The Booking calendar, Appointment Booking System plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.36.
- CVE-2025-67574Medium
The Booking calendar, Appointment Booking System plugin (by wpdevart) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Booking calendar, Appointment Booking System from n/a through <= 3.2.30.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS