CVE-2026-57778: Booking Calendar Auth Bypass Vulnerability

CVE-2026-57778 Overview

CVE-2026-57778 is a Missing Authorization vulnerability [CWE-862] affecting the wpdevart Booking calendar, Appointment Booking System WordPress plugin (booking-calendar). The flaw exists in versions up to and including 3.2.36 and stems from incorrectly configured access control security levels. Unauthenticated attackers can reach protected functionality over the network without user interaction. Successful exploitation results in a limited integrity impact on affected WordPress installations. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-07-13.

Critical Impact
Remote, unauthenticated attackers can invoke plugin functions that should be restricted, enabling modification of booking data without valid authorization.

Affected Products

wpdevart Booking calendar, Appointment Booking System plugin for WordPress
All versions from n/a through 3.2.36
WordPress sites running the booking-calendar plugin

Discovery Timeline

2026-07-13 - CVE-2026-57778 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57778

Vulnerability Analysis

The vulnerability is a Broken Access Control issue categorized under [CWE-862] Missing Authorization. The booking-calendar plugin exposes one or more actions that fail to verify the caller's capability or role before executing privileged logic. An attacker can reach the vulnerable endpoint directly over HTTP without authenticating.

The scope is limited to integrity. Attackers can alter data handled by the plugin, such as booking records or configuration values, but cannot read confidential data or crash the service through this flaw alone. The Exploit Prediction Scoring System (EPSS) rates near-term exploitation probability at roughly 0.29%.

Root Cause

The plugin exposes AJAX or REST handlers that omit capability checks such as current_user_can() and nonce verification through check_ajax_referer(). Access control decisions rely on client-supplied parameters rather than server-side authorization, allowing unauthorized callers to invoke functions reserved for privileged users.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting the vulnerable plugin. An attacker sends a crafted HTTP request to the plugin endpoint. Because authorization is missing, the request executes without valid credentials or an active session. No user interaction is required. Refer to the Patchstack Vulnerability Advisory for technical specifics.

No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-57778

Indicators of Compromise

Unexpected modifications to booking records, appointments, or plugin settings in the WordPress database
Anonymous POST requests to admin-ajax.php or plugin REST routes referencing the booking-calendar action names
HTTP requests to plugin endpoints originating from unauthenticated sessions with no valid nonce token

Detection Strategies

Review web server access logs for requests to wp-admin/admin-ajax.php where the action parameter targets the booking-calendar plugin from unauthenticated clients
Enable WordPress audit logging to record changes to booking data and identify unauthorized modifications
Deploy web application firewall (WAF) rules that require authenticated sessions for state-changing plugin actions

Monitoring Recommendations

Alert on high-volume POST traffic to plugin AJAX endpoints from single source IPs
Track anomalous changes in the wp_options table and booking-related tables created by the plugin
Correlate unauthenticated plugin requests with subsequent database writes to identify successful exploitation

How to Mitigate CVE-2026-57778

Immediate Actions Required

Update the Booking calendar, Appointment Booking System plugin to a version later than 3.2.36 once released by wpdevart
Audit existing booking records and plugin settings for unauthorized modifications
Restrict access to admin-ajax.php and plugin REST routes at the WAF layer until patched

Patch Information

At the time of NVD publication, versions up to and including 3.2.36 are affected. Site administrators should monitor the Patchstack Vulnerability Advisory and the official WordPress plugin repository for the fixed release and apply it as soon as it becomes available.

Workarounds

Disable the booking-calendar plugin until a patched version is installed
Enforce WAF rules that block anonymous POST requests targeting the plugin's action parameter values
Require authentication at the reverse proxy for admin-ajax.php if operationally feasible

bash

# Example: temporarily disable the plugin via WP-CLI
wp plugin deactivate booking-calendar
wp plugin status booking-calendar