← Back

CVE-2026-6810

nvd nist
Published: Apr 24, 2026Modified: Apr 24, 2026Deferred

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: security@wordfence.com

Description

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user's calendars and view user data associated with the calendar.

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (8)

Source: security@wordfence.com
Source: security@wordfence.com
Source: security@wordfence.com
Source: security@wordfence.com
Source: security@wordfence.com
Source: security@wordfence.com
Source: security@wordfence.com
Source: security@wordfence.com

Timeline

No history available yet.