Vulnerability · Published Feb 12, 2025 · Assigned by Wordfence
CVE-2024-13821WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
Medium 5.3
In plain English
A medium-severity security flaw in Booking Calendar from wpdevelop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This makes it possible for unauthenticated attackers to manipulate their confirmed bookings, even after they have been approved.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpdevelop | Booking Calendar | 0 – through 10.10 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N