CVE-2026-1431: Booking Calendar Information Disclosure

CVE-2026-1431 Overview

The Booking Calendar plugin for WordPress contains an authorization bypass vulnerability due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function. This vulnerability affects all versions up to and including 10.14.13, allowing unauthenticated attackers to access sensitive booking information without proper authorization.

Critical Impact

Unauthenticated attackers can retrieve sensitive customer booking information including names, phone numbers, and email addresses, potentially leading to privacy violations and secondary attacks.

Affected Products

• Booking Calendar plugin for WordPress versions up to and including 10.14.13

Discovery Timeline

• 2026-01-31 - CVE-2026-1431 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-1431

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), which occurs when a software component does not perform an authorization check when an actor attempts to access a resource or perform an action. In this case, the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in the Booking Calendar plugin processes AJAX requests without verifying whether the requesting user has appropriate permissions to access the data.

The function is designed to handle navigation within the FlexTimeline feature, which displays booking information. Without proper capability checks, the function responds to any request, authenticated or not, exposing sensitive customer data.

Root Cause

The root cause of this vulnerability is the absence of WordPress capability checks (such as current_user_can()) or nonce verification within the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function. WordPress plugins handling sensitive data should implement proper access control mechanisms to ensure only authorized users can retrieve or manipulate data. The vulnerable function, located in the AJAX handler at core/lib/wpbc-ajax.php, processes requests without validating the caller's authorization level.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication. An attacker can craft malicious AJAX requests to the WordPress admin-ajax.php endpoint, targeting the wpbc_ajax_WPBC_FLEXTIMELINE_NAV action. By manipulating request parameters, attackers can enumerate and retrieve booking records containing personally identifiable information (PII).

The attack requires no user interaction and can be automated to extract large volumes of customer data. Attackers can leverage this information for phishing campaigns, identity theft, or other malicious activities targeting the exposed individuals.

Detection Methods for CVE-2026-1431

Indicators of Compromise

• Unusual volume of AJAX requests to wp-admin/admin-ajax.php with the action parameter wpbc_ajax_WPBC_FLEXTIMELINE_NAV
• Requests to the vulnerable endpoint from unauthenticated sessions or unknown IP addresses
• Log entries showing repeated access to FlexTimeline AJAX handlers without corresponding authenticated sessions

Detection Strategies

• Monitor WordPress access logs for requests containing action=wpbc_ajax_WPBC_FLEXTIMELINE_NAV from unauthenticated sources
• Implement Web Application Firewall (WAF) rules to flag or block suspicious AJAX requests targeting the Booking Calendar plugin endpoints
• Review audit logs for any data exfiltration patterns or bulk retrieval of booking information

Monitoring Recommendations

• Enable detailed WordPress logging to capture AJAX request parameters and source IP addresses
• Set up alerts for anomalous request patterns targeting the admin-ajax.php endpoint
• Implement rate limiting on AJAX endpoints to slow down potential automated attacks

How to Mitigate CVE-2026-1431

Immediate Actions Required

• Update the Booking Calendar plugin to the latest patched version immediately
• Audit access logs to determine if the vulnerability has been exploited
• Consider temporarily disabling the Booking Calendar plugin if an update is not yet available
• Notify affected customers if unauthorized data access is confirmed

Patch Information

Review the WordPress Plugin Code Reference for technical details on the vulnerable code. The Wordfence Vulnerability Report provides additional advisory information. Website administrators should check for plugin updates through the WordPress admin dashboard and apply the security patch as soon as it becomes available.

Workarounds

• Implement server-level access controls to restrict access to admin-ajax.php from untrusted sources
• Use a Web Application Firewall to block requests targeting the wpbc_ajax_WPBC_FLEXTIMELINE_NAV action from unauthenticated users
• Add custom capability checks via a security plugin or custom code to validate user permissions before processing FlexTimeline requests

# Example .htaccess rule to restrict admin-ajax.php access (use with caution)
# This may affect legitimate plugin functionality
<Files admin-ajax.php>
    <RequireAll>
        Require all denied
        Require ip 192.168.1.0/24
    </RequireAll>
</Files>