Booking calendar, Appointment Booking System vulnerabilities

The Booking calendar, Appointment Booking System plugin version 3.2.36 and earlier has an insecure direct object references (IDOR) vulnerability that does not require authentication. This means an unauthenticated attacker can access objects (e.g., bookings) without authorization.

The Booking calendar, Appointment Booking System plugin for WordPress up to version 3.2.36 has an authorization bypass vulnerability. Unauthenticated attackers can mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional emails.

The Booking calendar, Appointment Booking System plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.2.36.