PT-2026-5502 · WordPress · Booking Calendar

Published 2026-01-31 · Updated 2026-01-31 · CVE-2026-1431

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 10.14.13

Description The Booking Calendar plugin for WordPress is susceptible to unauthorized data access. This is due to a missing capability check within the wpbc ajax WPBC FLEXTIMELINE NAV() function. This allows unauthenticated attackers to retrieve booking information, potentially including customer names, phone numbers, and email addresses.

Recommendations Update to a version newer than 10.14.13.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1431

Affected Products

Booking Calendar

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-1431 · Security Note
• https://plugins.trac.wordpress.org/browser/booking/tags/10.14.13/core/lib/wpbc-ajax.php#L25 · Note
• https://t.me/cveNotify/150487 · Telegram Post
• https://twitter.com/CVEnew/status/2017471828860489738 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0bd92f91-d9b1-4f6f-ac1a-477950ea2e80?source=cve · Note
• https://t.me/CVEtracker/43374 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2017469954182824121 · Twitter Post