Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Missing Authorization to Account Disconnection
- ID
- WPSEC-2026-0135
- Plugin
- Scheduling Plugin – Online Booking for WordPress (calendar-booking)
- Affected
- from 3.5.11 before 3.5.18
- Remediation
- Update to 3.5.18 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Scheduling Plugin – Online Booking for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check in the cbsb_disconnect_settings function in versions 3.5.11 up to, and including, 3.5.17. The function runs on admin_init, which also fires for unauthenticated requests to admin-ajax.php. It deletes the plugin's Start Booking connection and related options whenever the 'startbooking-disconnect' parameter is present. This makes it possible for unauthenticated attackers to disconnect the site from its Start Booking account and break booking on the site. This is the issue tracked as CVE-2024-1634, which was published as fixed in 3.5.11, but the function was unchanged in 3.5.11 through 3.5.17 and was first protected in 3.5.18. Versions before 3.5.11 are covered by the CVE-2024-1634 entry.
References
- https://wpsec.com/vuln/WPSEC-2026-0135/
- https://plugins.svn.wordpress.org/calendar-booking/tags/3.5.18/
- https://wordpress.org/plugins/calendar-booking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS