CVE-2026-74002: WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
Published Sep 17, 2026
·Updated
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
Affected Software
1 affected component
WordPress Booking Calendar plugin<=11.7
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Booking Calendar Pluginto a version that resolves this vulnerability.Fixed in 11.8
Event History
Sep 17, 2026
CVE Published
via MITRE·01:24 PM
Data Sourced
via MITRE·01:24 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an attacker to authenticate or rely on user interaction?
No. The vulnerability is rated as requiring no privileges and no user interaction.
2
What is the expected impact if the vulnerability is exploited?
The reported impact is limited to integrity, rated Low. No confidentiality or availability impact is reported.
3
How difficult is exploitation expected to be?
The attack vector is network-based and the attack complexity is rated Low.