🔐 CVE Alert

CVE-2024-13746

MEDIUM 6.5

Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on the wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() functions in all versions up to, and including, 4.0.3. This makes it possible for unauthenticated attackers to extract data, create or update bookings, or delete arbitrary posts.

CWE CWE-862
Vendor imznarf
Product booking calendar and notification
Published Mar 1, 2025
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for imznarf booking calendar and notification

Be the first to know when new medium vulnerabilities affecting imznarf booking calendar and notification are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

imznarf / Booking Calendar and Notification
0 ≤ 4.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/422bb9a5-c848-4492-add7-bc65b1111565?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/tags/4.0.3/lib/includes/function.php plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L270 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L134 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L188

Credits

Pham Van Tam Hoang Phuc Vo