CVE-2026-6810: WordPress Booking Calendar IDOR Vulnerability

CVE-2026-6810 Overview

The Booking Calendar Contact Form plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 1.2.63. The vulnerability exists in the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user-controlled key. This flaw allows authenticated attackers with Subscriber-level access or above to take over other users' calendars and access sensitive user data associated with those calendars.

Critical Impact
Authenticated attackers with minimal privileges (Subscriber-level) can exploit this IDOR vulnerability to hijack calendars belonging to other users and exfiltrate associated user data, potentially exposing booking information, personal details, and other sensitive calendar entries.

Affected Products

Booking Calendar Contact Form plugin for WordPress versions up to and including 1.2.63
WordPress installations running vulnerable versions of the plugin
Any website utilizing the affected plugin's calendar functionality

Discovery Timeline

2026-04-24 - CVE-2026-6810 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-6810

Vulnerability Analysis

This vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key, commonly known as an Insecure Direct Object Reference (IDOR). The vulnerable code resides in the administrative calendar list functionality of the plugin, specifically within the dex_bccf_admin_int_calendar_list.inc.php file.

The core issue stems from the plugin's failure to properly validate ownership or authorization when users reference calendar objects. When a request is made to access or modify a calendar, the plugin accepts a user-supplied calendar identifier without verifying that the requesting user has legitimate access rights to that specific calendar resource.

This authorization bypass allows any authenticated user—even those with the lowest privilege level (Subscriber)—to manipulate the calendar identifier parameter and gain unauthorized access to calendars owned by other users, including administrators. The attack can be executed over the network without any user interaction, making it particularly concerning for multi-user WordPress environments.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks in the calendar management functionality. The dex_bccf_admin_int_calendar_list.inc.php file processes calendar-related requests using a user-controlled key (calendar ID) without validating whether the authenticated user has permission to access or modify the specified calendar resource.

In secure implementations, the application should verify that the current user is either the owner of the requested calendar or has administrative privileges before granting access. The vulnerable code path accepts the calendar identifier directly from user input and processes the request without this critical ownership verification step.

Attack Vector

The attack vector is network-based and requires only low-privilege authentication (Subscriber-level account). An attacker can exploit this vulnerability by:

Authenticating to the WordPress site with a Subscriber or higher-level account
Identifying or enumerating valid calendar IDs belonging to other users
Crafting requests to the vulnerable endpoint with manipulated calendar identifiers
Gaining unauthorized read/write access to other users' calendars
Extracting sensitive booking data and user information from compromised calendars

The vulnerability exists in the administrative interface at line 38 and line 71 of the dex_bccf_admin_int_calendar_list.inc.php file, as well as related functionality in dex_bccf.php at line 608. These code locations handle calendar object references without proper authorization controls.

Detection Methods for CVE-2026-6810

Indicators of Compromise

Unusual access patterns in WordPress access logs showing Subscriber-level users accessing calendar administrative functions
Multiple calendar ID parameters being enumerated in rapid succession from single user sessions
Unexpected modifications to calendar entries by users who are not the calendar owners
Access log entries showing requests to dex_bccf_admin_int_calendar_list.inc.php from low-privilege accounts

Detection Strategies

Implement web application firewall (WAF) rules to detect sequential enumeration of calendar ID parameters
Monitor WordPress audit logs for Subscriber-level users accessing calendar management endpoints
Deploy endpoint detection to identify anomalous plugin file access patterns
Review Apache/Nginx access logs for suspicious parameter manipulation targeting the vulnerable PHP files

Monitoring Recommendations

Enable detailed WordPress activity logging for all authenticated user actions
Configure alerts for Subscriber-level accounts accessing administrative plugin functionality
Monitor for rapid sequential requests that may indicate calendar ID enumeration attempts
Set up file integrity monitoring for the Booking Calendar Contact Form plugin directory

How to Mitigate CVE-2026-6810

Immediate Actions Required

Update the Booking Calendar Contact Form plugin to a version newer than 1.2.63 immediately
Audit existing calendar data for signs of unauthorized access or modification
Review WordPress user accounts and revoke unnecessary Subscriber-level access
Consider temporarily disabling the plugin until patching is complete in high-security environments

Patch Information

A patch is available for this vulnerability. The fix can be reviewed in the WordPress Plugin Changeset which implements proper authorization checks for calendar object access. WordPress administrators should update through the standard WordPress plugin update mechanism or download the patched version directly from the WordPress plugin repository.

Additional technical details and security analysis are available in the Wordfence Vulnerability Report.

Workarounds

Restrict user registration and remove unnecessary Subscriber-level accounts until patching is complete
Implement additional access controls at the web server level to restrict access to administrative plugin files
Use a WordPress security plugin to add extra authorization layers to plugin administrative functions
Consider implementing IP-based access restrictions for WordPress administrative areas

bash

# Example: Restrict access to vulnerable plugin files via .htaccess
# Add to wp-content/plugins/booking-calendar-contact-form/.htaccess
<Files "dex_bccf_admin_int_calendar_list.inc.php">
    Order Deny,Allow
    Deny from all
    # Allow only from trusted admin IPs
    Allow from 192.168.1.0/24
</Files>