CVE-2026-95513: WordPress vcita Calendar Auth Bypass Flaw

CVE-2026-95513 Overview

CVE-2026-95513 is an unauthenticated broken access control vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin. The flaw affects all versions up to and including 4.6.0. Remote attackers can reach protected functionality over the network without authentication and without user interaction. The underlying weakness is missing authorization [CWE-862], allowing unauthorized state changes against affected WordPress sites.

Critical Impact
Unauthenticated network attackers can invoke privileged plugin actions and modify booking or scheduling data without valid credentials.

Affected Products

Online Booking & Scheduling Calendar for WordPress by vcita (plugin slug: meeting-scheduler-by-vcita)
Plugin versions <= 4.6.0
WordPress installations with the vulnerable plugin active

Discovery Timeline

2026-09-23 - CVE-2026-95513 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95513

Vulnerability Analysis

The plugin exposes one or more request handlers that perform sensitive operations without verifying the caller's identity or capability. Because the endpoints are reachable over HTTP(S) and require no authentication, an attacker can send crafted requests directly to the vulnerable action. The flaw impacts integrity: attackers can create, alter, or remove data managed by the plugin. Confidentiality and availability are not directly impacted based on the reported scoring.

Root Cause

The root cause is missing authorization [CWE-862]. The affected handlers do not enforce current_user_can() capability checks or validate nonces before executing privileged logic. Requests from anonymous users are processed with the same trust level as administrative requests, breaking the WordPress permission model.

Attack Vector

Exploitation occurs over the network against any WordPress site running the vulnerable plugin. An attacker sends a direct HTTP request to the exposed plugin endpoint, such as an admin-ajax.php action or a REST route registered by the plugin. No credentials, tokens, or user interaction are required. Refer to the Patchstack Vulnerability Report for endpoint-level detail.

Detection Methods for CVE-2026-95513

Indicators of Compromise

Unauthenticated POST or GET requests to admin-ajax.php referencing plugin-specific action names from meeting-scheduler-by-vcita.
Requests to REST routes registered by the vcita plugin from IP addresses that never authenticated to wp-login.php.
Unexpected creation, modification, or deletion of booking records or plugin configuration entries in the WordPress database.

Detection Strategies

Inspect web server access logs for anonymous requests targeting plugin AJAX actions or REST endpoints.
Correlate database write events on plugin tables with the absence of a matching authenticated session.
Alert on repeated requests to plugin endpoints originating from a single IP outside normal administrative activity.

Monitoring Recommendations

Enable WordPress audit logging for plugin option changes and content modifications.
Forward WordPress and web server logs to a centralized SIEM for correlation with authentication events.
Monitor plugin version inventory to identify hosts still running meeting-scheduler-by-vcita at version <= 4.6.0.

How to Mitigate CVE-2026-95513

Immediate Actions Required

Identify all WordPress sites running the Online Booking & Scheduling Calendar for WordPress by vcita plugin at version <= 4.6.0.
Update the plugin to a version above 4.6.0 as soon as the vendor releases a patched build.
If a patched release is not yet available, deactivate and remove the plugin from production sites.

Patch Information

At the time of publication, the Patchstack Vulnerability Report is the authoritative reference for fix availability. Administrators should apply the vendor update as soon as it is published in the WordPress plugin repository.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests to the plugin's AJAX actions and REST routes.
Restrict access to wp-admin/admin-ajax.php and plugin REST endpoints by IP where operationally feasible.
Disable the plugin until a fixed version is installed and verified.

bash

# Example WAF-style rule: block unauthenticated calls to plugin AJAX actions
# Replace <plugin_action> with the specific action names identified in logs
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1095513,msg:'Block unauth vcita plugin action'"
    SecRule ARGS:action "@rx ^(vcita|meeting_scheduler)_" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"