CVE-2026-73395

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

The Booking calendar, Appointment Booking System plugin version 3.2.36 and earlier has an insecure direct object references (IDOR) vulnerability that does not require authentication. This means an unauthenticated attacker can access objects (e.g., bookings) without authorization.

Risk Assessment

The risk is that an attacker can access sensitive data or resources, potentially leading to confidentiality and integrity breaches.

Recommendation

It is recommended to update the plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.