CVE-2026-39601: WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability
Published Oct 2, 2026
·Updated
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.
Affected Software
1 affected component
WPdevelop Booking Calendar<=11.8.4
Event History
Oct 2, 2026
CVE Published
via MITRE·02:49 PM
Data Sourced
via MITRE·02:49 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
WPdevelop Booking Calendar versions through 11.8.4 are affected. The available data does not identify a minimum affected version.
2
What access does an attacker need?
The CVSS vector indicates the issue is network-accessible and requires no privileges or user interaction. Exploitation has high attack complexity.
3
What is the expected impact?
The reported impact is limited to integrity, with no reported confidentiality or availability impact. The CVSS base score is 3.7 (low).