Vulnerabilities / Appointment Booking Plugin & Scheduling System – Webba Booking Calendar / WPSEC-2026-0850
Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.2 - Unauthenticated Insecure Direct Object Reference to Gift Card Code Disclosure via Gift Card Status REST Endpoint
Medium 6.5
CWE-639Fixed in 6.5.3
- ID
- WPSEC-2026-0850
- Plugin
- Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar (webba-booking-lite)
- Affected
- all versions before 6.5.3
- Remediation
- Update to 6.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- Appointment Booking Plugin & Scheduling System – Webba Booking Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The Webba Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference via the gift-card-status REST endpoint (wbk/v2/gift-card-status) in all versions up to, and including, 6.5.2. This is due to the endpoint having no permission check, looking up gift cards by a sequential, user-controlled integer ID and returning each card's redeemable code. This makes it possible for unauthenticated attackers to enumerate gift card IDs, obtain the codes, balances and expiration dates of other customers' gift cards, and redeem those cards.
References
- https://wpsec.com/vuln/WPSEC-2026-0850/
- https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.3/
- https://wordpress.org/plugins/webba-booking-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS