Scheduling Plugin – Online Booking for WordPress < 3.5.18 - Authenticated (Subscriber+) Missing Authorization to Account Connection and Plugin Settings Modification
- ID
- WPSEC-2026-0136
- Plugin
- Scheduling Plugin – Online Booking for WordPress (calendar-booking)
- Affected
- all versions before 3.5.18
- Remediation
- Update to 3.5.18 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Scheduling Plugin – Online Booking for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks and missing nonce checks on several AJAX actions in all versions up to, and including, 3.5.17. These include cbsb_new_free_trial, cbsb_check_free_trial, cbsb_app_connect_user, cbsb_app_connect_account, cbsb_access_account, cbsb_get_booking_pages, cbsb_request_access, cbsb_dismiss_notice, cbsb_store_account_activated and cbsb_access_wpcom_account. This makes it possible for authenticated attackers with subscriber-level access and above to replace the site's Start Booking connection with a newly registered or attacker-controlled account. New bookings would then be sent to that account. Attackers can also obtain the site's account tokens in their own user profile and update plugin options that are intended for administrators only.
References
- https://wpsec.com/vuln/WPSEC-2026-0136/
- https://plugins.svn.wordpress.org/calendar-booking/tags/3.5.18/
- https://wordpress.org/plugins/calendar-booking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS