Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
Booking Calendar plugin for WordPress allows attackers to change other users' settings
CVE-2026-2230
Summary
Attackers with certain permissions can change the booking calendar settings for other users, disrupting their booking functionality. This can happen in versions up to 10.14.14 of the Booking Calendar plugin for WordPress. If you're using this plugin, you should update to a fixed version to prevent unauthorized changes to settings.
Original title
The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validatio...
Original description
The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, and booking permissions granted by an Administrator, to modify other users' plugin settings, such as booking calendar display options, which can disrupt the booking calendar functionality for the targeted user.
nvd CVSS3.1
4.3
Vulnerability type
CWE-639
Authorization Bypass Through User-Controlled Key
Published: 18 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026