CVE-2026-73395: WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
Published Aug 18, 2026
·Updated
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
Affected Software
1 affected component
WordPress Booking calendar, Appointment Booking System<=3.2.36
Event History
Aug 18, 2026
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
Sites using the WordPress Booking calendar, Appointment Booking System plugin at version 3.2.36 or earlier are affected according to the provided information. The issue is remotely reachable and requires no authentication or user interaction.
2
What does an attacker need to exploit this issue?
An unauthenticated attacker can exploit the IDOR condition over the network with low attack complexity. The listed impacts are integrity and availability; no confidentiality impact is indicated.