CVE-2026-95513: WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Online Booking & Scheduling Calendar for WordPress by vcitato a version that resolves this vulnerability.Fixed in 4.6.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges to exploit an affected installation.
Which installations are affected?
Online Booking & Scheduling Calendar for WordPress by vcita versions 4.6.0 and earlier are affected. The available information does not state whether any particular configuration is required.
What is the likely security impact?
The supplied severity vector indicates low-complexity network exploitation with no user interaction and an integrity impact. It does not indicate confidentiality or availability impact.