{
 "id": "WPSEC-2026-0850",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0850/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0850/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0850/index.md",
 "title": "Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.2 - Unauthenticated Insecure Direct Object Reference to Gift Card Code Disclosure via Gift Card Status REST Endpoint",
 "description": "The Webba Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference via the gift-card-status REST endpoint (wbk/v2/gift-card-status) in all versions up to, and including, 6.5.2. This is due to the endpoint having no permission check, looking up gift cards by a sequential, user-controlled integer ID and returning each card's redeemable code. This makes it possible for unauthenticated attackers to enumerate gift card IDs, obtain the codes, balances and expiration dates of other customers' gift cards, and redeem those cards.",
 "plugin": {
  "slug": "webba-booking-lite",
  "name": "Appointment Booking Plugin & Scheduling System – Webba Booking Calendar",
  "full_name": "Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar",
  "wordpress_org": "https://wordpress.org/plugins/webba-booking-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/webba-booking-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/webba-booking-lite"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.5.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.5.3",
 "remediation": "Update to 6.5.3 or later.",
 "fix_released": "2026-10-12T17:06:26+00:00",
 "published": "2026-10-13T20:09:59+00:00",
 "updated": "2026-10-13T12:13:05.973607+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0850/",
  "https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.3/",
  "https://wordpress.org/plugins/webba-booking-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/webba-booking-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}