CVE-2026-105193 in Booking Calendar Plugin
Summary
by MITRE • 10/08/2026
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The Booking Calendar WordPress plugin prior to version 11.8 contains a critical security flaw related to the generation of access hashes for individual bookings. These hashes are intended to serve as unique, unpredictable identifiers that grant authorized users specific permissions to view or edit their respective booking details without requiring full administrative authentication. The vulnerability arises because the system derives these per-booking access hashes from a time-seeded value rather than using a cryptographically secure random number generator with high entropy. This design choice results in low entropy for the generated tokens, making them susceptible to prediction if an attacker can determine or estimate the timestamp associated with the booking's creation.
From a technical perspective, this flaw represents a classic instance of insufficient randomness leading to predictable identifiers. When software relies on system time as a seed for generating security-critical values such as access tokens or session IDs, it introduces significant predictability. If an attacker can observe when a booking is created, either through network traffic analysis, public listing timestamps, or other side-channel information, they can narrow down the possible range of seeds used to generate the hash. Given that time-based seeds often have limited granularity and predictable progression patterns, brute-forcing or predicting the correct hash becomes computationally feasible for an unauthenticated attacker. This effectively bypasses the intended access control mechanisms designed to protect sensitive user data.
The operational impact of this vulnerability is severe, as it allows unauthenticated attackers to compromise both confidentiality and integrity within the application context. By successfully predicting a booking's access hash, an attacker can directly read personal data associated with that booking, such as names, contact information, dates, and potentially payment details depending on plugin configuration. Furthermore, the ability to predict these hashes enables in-place modification of bookings. An attacker could alter appointment times, cancel reservations, or change other critical attributes without authorization. This not only violates user privacy but also disrupts business operations for organizations relying on the Booking Calendar plugin for scheduling services.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-330, which covers the use of insufficiently random values in security contexts. It is particularly dangerous because it undermines the fundamental assumption that generated identifiers are unique and unpredictable. In terms of cyber attack frameworks, this behavior corresponds to ATT&CK technique T1528, Steal Application Access Token, where attackers exploit weak token generation mechanisms to gain unauthorized access. The lack of proper entropy makes the system vulnerable to brute-force attacks against the hash space, especially if the time seed has low resolution or is exposed through other means such as HTTP headers or page load times.
Mitigation strategies must focus on immediate remediation and long-term security hardening. Users running versions of the Booking Calendar plugin prior to 11.8 should upgrade immediately to version 11.8 or later, where this issue has been addressed by implementing cryptographically secure random number generation for access hashes. Until an update is applied, administrators can consider temporary workarounds such as restricting public visibility of booking details and ensuring that no sensitive personal data is stored in fields accessible via the vulnerable endpoint. Additionally, reviewing server logs to identify any potential exploitation attempts based on unusual patterns of hash requests or timing anomalies can help detect ongoing attacks. Regular security audits and adherence to secure coding practices that prioritize high-entropy random number generation are essential for preventing similar vulnerabilities in future developments.