CVE-2026-2230: WordPress Booking Calendar Auth Bypass Flaw

CVE-2026-2230 Overview

CVE-2026-2230 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Booking Calendar plugin for WordPress in all versions up to and including 10.14.14. The flaw exists in the handle_ajax_save function, which fails to validate a user-controlled key before persisting settings. Authenticated attackers with Subscriber-level access or higher, combined with booking permissions granted by an administrator, can modify other users' plugin settings. The issue is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
Authenticated users with booking permissions can alter the booking calendar display options of other users, disrupting their booking calendar functionality.

Affected Products

Booking Calendar plugin for WordPress versions up to and including 10.14.14
WordPress sites granting booking permissions to Subscriber-level accounts
WordPress installations using the vulnerable handle_ajax_save AJAX endpoint

Discovery Timeline

2026-02-18 - CVE-2026-2230 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-2230

Vulnerability Analysis

The Booking Calendar plugin exposes an AJAX action handled by the handle_ajax_save function inside includes/save-user-meta/save-user-meta.php. This handler accepts a key parameter from the client and writes plugin settings against that identifier without confirming the requesting user owns the target object. The plugin enforces authentication and a booking-permission capability check, but it does not bind the write operation to the authenticated user's identity.

The vulnerability falls under CWE-639: the access control decision relies on a value supplied by the client. Because the impact is limited to integrity of booking calendar display settings, the confidentiality and availability impact are absent or low. Refer to the WordPress Plugin Code Review for the affected source and to the Wordfence Vulnerability Report for additional context.

Root Cause

The root cause is missing validation that the user-controlled key passed to handle_ajax_save corresponds to the authenticated user's own settings record. The handler trusts the supplied identifier and writes the associated user meta directly. There is no ownership check linking the current wp_get_current_user() identity to the target key.

Attack Vector

An attacker must first obtain a Subscriber-level or higher account and be granted booking permissions by an administrator. From that authenticated session, the attacker issues an AJAX request to the plugin's save endpoint and substitutes another user's identifier in the key parameter. The server-side handler accepts the request and overwrites the victim's booking calendar display options.

The vulnerability is exploited over the network without user interaction, but it requires valid plugin-level permissions, which constrains the attack population to authorized booking users. No public proof-of-concept is listed in the enriched data, and the issue is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-2230

Indicators of Compromise

Unexpected changes to booking calendar display options for users who did not initiate the change
POST requests to the WordPress admin-ajax.php endpoint invoking the Booking Calendar save action with key parameters that do not match the requesting user's ID
Booking workflow disruptions reported by multiple users with no corresponding administrator action

Detection Strategies

Audit WordPress access logs for repeated AJAX calls to the Booking Calendar save handler from low-privilege accounts
Compare the authenticated session user ID against the key parameter submitted to the save endpoint and alert on mismatches
Review the plugin's user meta table for modifications made by accounts other than the meta record owner

Monitoring Recommendations

Enable WordPress activity logging for plugin settings changes and Subscriber-level account actions
Monitor the Booking Calendar plugin version across all WordPress sites and flag instances at or below 10.14.14
Forward web server and admin-ajax.php logs to a centralized analytics platform for correlation and anomaly review

How to Mitigate CVE-2026-2230

Immediate Actions Required

Update the Booking Calendar plugin to the version released in WordPress Changeset #3456856, which is the patched release above 10.14.14
Review which Subscriber-level accounts have been granted booking permissions and revoke access where not required
Audit the plugin's user meta records for unauthorized modifications and restore affected settings

Patch Information

The vendor addressed the issue in the Booking Calendar plugin release associated with WordPress Changeset #3456856. The fix introduces validation that ties the save operation to the authenticated user's identity, preventing modification of another user's plugin settings through the handle_ajax_save handler.

Workarounds

Temporarily revoke booking permissions from non-administrator accounts until the patched plugin version is deployed
Restrict access to wp-admin/admin-ajax.php for Subscriber-level users using a web application firewall rule scoped to the Booking Calendar action
Disable the Booking Calendar plugin on sites where booking functionality is not actively required

bash

# Update the Booking Calendar plugin to a patched version using WP-CLI
wp plugin update booking --version=10.14.15
wp plugin list --name=booking --fields=name,status,version