CVE-2024-13746 MEDIUM

CVE-2024-13746: Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions

Vendor Imznarf
Product Booking Calendar and Notification
Weakness CWE-862 · Missing authorization
Published March 1, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on the wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() functions in all versions up to, and including, 4.0.3. This makes it possible for unauthenticated attackers to extract data, create or update bookings, or delete arbitrary posts.

Key dates

02Disclosure timeline

March 1, 2025 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-39563 WordPress Share This Image plugin <= 2.12 - Broken Access Control vulnerability CVE-2026-40742 WordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability CVE-2024-35716 WordPress Copymatic plugin <= 1.9 - Broken Access Control vulnerability CVE-2023-37971 WordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerability CVE-2025-12582 Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset