Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Unauthenticated Authorization Bypass to Admin-Scoped REST API Proxy
- ID
- WPSEC-2026-0133
- Plugin
- Scheduling Plugin – Online Booking for WordPress (calendar-booking)
- Affected
- from 2.0.0 before 3.5.18
- Remediation
- Update to 3.5.18 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Scheduling Plugin – Online Booking for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to an authorization bypass in its Start Booking REST API proxy in all versions up to, and including, 3.5.17. This is due to an incorrect token validation: the supplied 'x-startbooking-token' header value was turned into a boolean and loosely compared against stored tokens. In addition, every accepted request was granted the 'wp-admin' scope, including the public booking-flow token printed on booking pages. This makes it possible for unauthenticated attackers to send admin-scoped requests through the proxy to the site's connected Start Booking account, potentially exposing or altering booking data.
References
- https://wpsec.com/vuln/WPSEC-2026-0133/
- https://plugins.svn.wordpress.org/calendar-booking/tags/3.5.18/
- https://wordpress.org/plugins/calendar-booking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS