PT-2025-9148 · WordPress · Booking Calendar/Notification

Hoang Phuc Vo + 2 · Published 2025-03-01 · Updated 2025-03-02 · CVE-2024-13746

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Booking Calendar and Notification plugin for WordPress versions prior to 4.0.4

Description The issue allows unauthorized access, modification, and loss of data due to missing capability checks on the wpcb all bookings(), wpcb update booking post(), and wpcb delete posts() functions. This enables unauthenticated attackers to extract data, create or update bookings, or delete arbitrary posts.

Recommendations For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the wpcb all bookings(), wpcb update booking post(), and wpcb delete posts() functions until a patch is available. Restrict access to these functions to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13746

Affected Products

Booking Calendar/Notification

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-13746 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/422bb9a5-c848-4492-add7-bc65b1111565?source=cve · Note
• https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L188 · Note
• https://t.me/cvenotify/112960 · Telegram Post
• https://t.me/cvedetector/19209 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1895710667266556367 · Twitter Post
• https://twitter.com/CVEnew/status/1895982005256683808 · Twitter Post
• https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L270 · Note
• https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/tags/4.0.3/lib/includes/function.php · Note
• https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L134 · Note
• https://twitter.com/cybercronai/status/1896153938933453063 · Twitter Post