Vulnerabilities / Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar / WPSEC-2026-1929
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.4 - Authenticated (Subscriber+) Improper Input Validation to Booking Rescheduling Into Unavailable Timeslots
Medium 4.3
CWE-20Fixed in 6.5.5
- ID
- WPSEC-2026-1929
- Plugin
- Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar (webba-booking-lite)
- Affected
- all versions before 6.5.5
- Remediation
- Update to 6.5.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The Webba Booking Calendar plugin for WordPress is vulnerable to improper input validation via the wbk/v2/update-booking REST endpoint in all versions up to, and including, 6.5.4, due to the update_booking() function saving the requested booking time without checking that it is an existing timeslot of the booking's service with enough free places. This makes it possible for authenticated attackers, with subscriber-level access and above, to move bookings made with their own email address to any future time, bypassing the configured schedule and capacity limits.
References
- https://wpsec.com/vuln/WPSEC-2026-1929/
- https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.5/
- https://wordpress.org/plugins/webba-booking-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS