# Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.2 - Unauthenticated Insecure Direct Object Reference to Gift Card Code Disclosure via Gift Card Status REST Endpoint

- **ID:** WPSEC-2026-0850
- **Plugin:** Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar (`webba-booking-lite`), https://wordpress.org/plugins/webba-booking-lite/
- **Affected versions:** all versions before 6.5.3
- **Fixed in:** 6.5.3 (Update to 6.5.3 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/webba-booking-lite
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0850/

## Description

The Webba Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference via the gift-card-status REST endpoint (wbk/v2/gift-card-status) in all versions up to, and including, 6.5.2. This is due to the endpoint having no permission check, looking up gift cards by a sequential, user-controlled integer ID and returning each card's redeemable code. This makes it possible for unauthenticated attackers to enumerate gift card IDs, obtain the codes, balances and expiration dates of other customers' gift cards, and redeem those cards.

## References

- https://wpsec.com/vuln/WPSEC-2026-0850/
- https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.3/
- https://wordpress.org/plugins/webba-booking-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0850/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.