CVE-2025-13318: WordPress Booking Calendar Auth Bypass

CVE-2025-13318 Overview

CVE-2025-13318 is a Missing Authorization vulnerability [CWE-862] in the Booking Calendar Contact Form plugin for WordPress. The flaw exists in all versions up to and including 1.2.60. The dex_bccf_check_IPN_verification function lacks authorization checks and payment verification logic. Unauthenticated attackers can send crafted requests using the dex_bccf_ipn parameter to confirm bookings and bypass payment requirements. The issue affects the plugin's Instant Payment Notification (IPN) handling path used to validate transactions from payment processors.

Critical Impact
Unauthenticated attackers can confirm arbitrary bookings and bypass payment requirements on affected WordPress sites, causing revenue loss and inventory manipulation.

Affected Products

Booking Calendar Contact Form plugin for WordPress, versions up to and including 1.2.60
WordPress sites using the plugin's IPN payment verification workflow
Any deployment relying on dex_bccf_check_IPN_verification for booking confirmation

Discovery Timeline

2025-11-22 - CVE-2025-13318 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13318

Vulnerability Analysis

The vulnerability resides in the dex_bccf_check_IPN_verification function within dex_bccf.php. This function processes Instant Payment Notification callbacks intended to confirm booking payments after a payment provider validates a transaction. The function is registered on a public endpoint reachable without authentication.

Because the function neither performs authorization checks nor validates that the incoming IPN payload originated from a legitimate payment provider, an attacker can forge requests. Submitting a request containing the dex_bccf_ipn parameter causes the plugin to treat the booking as paid and confirmed. The vulnerability is a business logic flaw combined with a missing access control check on a sensitive callback endpoint.

Root Cause

The root cause is the absence of both a capability check and cryptographic verification of the IPN payload. Legitimate IPN workflows require the receiving server to call back to the payment processor to confirm the transaction identifier and amount. The plugin skips this verification step and trusts client-supplied parameters. This aligns with CWE-862 Missing Authorization.

Attack Vector

The attack is remote and requires no authentication or user interaction. An attacker sends an HTTP request to the plugin's IPN handler containing the dex_bccf_ipn parameter with values referencing a target booking. The plugin marks the booking as paid without validating the payment. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the vulnerable function reference.

// No verified exploit code is publicly available.
// The vulnerability is triggered by unauthenticated HTTP requests
// containing the dex_bccf_ipn parameter targeting the plugin's IPN endpoint.

Detection Methods for CVE-2025-13318

Indicators of Compromise

HTTP requests to the WordPress site containing the dex_bccf_ipn parameter from unexpected source IP addresses
Bookings marked as confirmed or paid without corresponding transactions in the payment processor's dashboard
Access log entries referencing the plugin's IPN endpoint at unusual frequencies or outside business hours

Detection Strategies

Correlate booking confirmation events in the WordPress database with payment processor transaction records to identify mismatches
Monitor web server access logs for requests invoking the Booking Calendar Contact Form IPN handler and flag those lacking valid payment processor origin
Enable WordPress audit logging to record changes to booking status and identify confirmations without an authenticated administrative action

Monitoring Recommendations

Deploy a web application firewall rule to inspect requests containing dex_bccf_ipn and validate the source against known payment provider IP ranges
Alert on repeated POST requests targeting plugin endpoints from a single source IP within short time windows
Review new bookings daily for entries with confirmed status but missing external payment reference identifiers

How to Mitigate CVE-2025-13318

Immediate Actions Required

Update the Booking Calendar Contact Form plugin to the version that follows 1.2.60 as published by the plugin author
Audit all bookings created since deploying the plugin for unauthorized confirmations and reconcile against payment processor records
Restrict access to the plugin's IPN endpoint at the web server or WAF layer until patching is confirmed

Patch Information

Review the WordPress Plugin Changeset Summary for the code changes that address the missing authorization check. Site administrators should upgrade through the WordPress plugin manager and verify the installed version is greater than 1.2.60.

Workarounds

Disable the Booking Calendar Contact Form plugin until an updated version is installed and validated
Block external access to the plugin's IPN callback URL and allowlist only payment processor IP ranges at the web server or reverse proxy
Implement out-of-band reconciliation between WordPress booking status and payment processor transaction logs before honoring bookings

bash

# Example nginx allowlist restricting IPN endpoint access to payment processor ranges
location ~* /wp-content/plugins/booking-calendar-contact-form/ {
    if ($arg_dex_bccf_ipn) {
        allow 173.0.80.0/20;   # example payment processor range
        deny all;
    }
}