Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

Booking Calendar plugin may let unauthorized bookings

CVE-2026-39601 · published 16 days ago
Summary

The Booking Calendar add‑on for WordPress (versions up to 11.8.4) can be tricked into processing two requests at the same time, which may let an attacker create or change bookings they shouldn’t control. This could lead to false appointments or loss of scheduling data. Update the plugin to the latest version or remove it if you cannot apply the update.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wpdevelop booking calendar <= 11.8.4
Original advisory text
WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published2 Oct 2026
Updated14 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-39601 · NVD
CVE-2026-39601 · MITRE
Track software like this
Free during beta