CVE-2026-95513 in Online Booking & Scheduling Calendar Plugin
Summary
by MITRE • 09/23/2026
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified as an unbroken access control issue within the Online Booking and Scheduling Calendar plugin for WordPress, specifically affecting versions up to 4.6.0, represents a critical security flaw that allows unauthorized users to interact with sensitive administrative functions without proper authentication. This type of vulnerability falls squarely under CWE-285, which describes Improper Authorization, where an application fails to properly verify the rights of a user before allowing them to perform specific actions or access certain data. In the context of WordPress plugins, such flaws often arise when developers fail to implement robust nonce verification and capability checks for AJAX handlers or REST API endpoints that process booking requests, calendar configurations, or administrative settings. The absence of these security controls means that any individual on the internet can craft malicious HTTP requests to manipulate the plugin's internal logic, bypassing the standard WordPress authentication mechanisms entirely.
From a technical perspective, this flaw typically manifests through insecure direct object references or missing access control checks in server-side processing scripts. Attackers can exploit this by sending specially crafted POST or GET requests to specific endpoints exposed by the plugin, such as those responsible for creating new appointments, modifying existing schedules, or accessing user-specific booking data. Because the system does not validate whether the requester has the necessary administrator privileges or even a valid session token, it processes these commands as if they originated from an authenticated admin user. This lack of server-side validation is particularly dangerous because client-side security measures can be easily bypassed using standard web tools like curl or Burp Suite, allowing attackers to automate exploitation at scale without needing any prior credentials or knowledge of the target site's internal structure beyond its URL.
The operational impact of this vulnerability is severe and multifaceted, primarily affecting the confidentiality, integrity, and availability of the hosted WordPress application. An attacker can potentially create fraudulent bookings that clutter the calendar interface, leading to service disruption for legitimate users and damaging the reputation of the business relying on the scheduling tool. More critically, if the plugin handles sensitive customer data such as names, email addresses, phone numbers, or payment information within its database tables accessible through these endpoints, an attacker could exfiltrate this personally identifiable information. This constitutes a significant privacy violation and may lead to compliance issues with regulations like GDPR or CCPA. Furthermore, depending on how the plugin integrates with other systems, such as CRM tools or email services, successful exploitation could allow for further lateral movement within the network infrastructure, potentially leading to broader system compromise if additional vulnerabilities are present in related components.
In terms of industry frameworks, this vulnerability aligns closely with MITRE ATT&CK technique T1078, Valid Accounts, although in this specific case it is more accurately described as an abuse of trust or lack of authentication requirements rather than the use of stolen credentials. It also relates to CWE-639, Authorization Bypass Through User-Controlled Key, if the exploitation relies on manipulating identifiers within requests to access resources belonging to other users or administrative functions. The severity is heightened by the widespread adoption of WordPress and this specific plugin family, meaning that a successful exploit could impact thousands of websites simultaneously if they remain unpatched. Attackers often use automated scanners to identify such vulnerabilities across large segments of the internet, making prompt remediation essential for maintaining security posture.
To mitigate this risk, site administrators must immediately update the Online Booking and Scheduling Calendar plugin to version 4.6.1 or later, where these access control issues have been addressed by implementing strict nonce verification and capability checks on all AJAX handlers and API endpoints. It is crucial to verify that the updated version explicitly validates user roles before processing any administrative actions. Additionally, organizations should employ a Web Application Firewall configured with rulesets designed to detect common exploitation patterns associated with broken access controls in WordPress environments. Regular security audits and penetration testing focused on authentication bypasses are recommended to ensure no similar vulnerabilities exist in other plugins or custom code within the same environment. Monitoring server logs for unusual spikes in requests to plugin-specific endpoints can also serve as an early warning system for potential exploitation attempts, allowing for rapid incident response before significant damage occurs.