{
 "id": "WPSEC-2026-1929",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1929/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1929/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1929/index.md",
 "title": "Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.4 - Authenticated (Subscriber+) Improper Input Validation to Booking Rescheduling Into Unavailable Timeslots",
 "description": "The Webba Booking Calendar plugin for WordPress is vulnerable to improper input validation via the wbk/v2/update-booking REST endpoint in all versions up to, and including, 6.5.4, due to the update_booking() function saving the requested booking time without checking that it is an existing timeslot of the booking's service with enough free places. This makes it possible for authenticated attackers, with subscriber-level access and above, to move bookings made with their own email address to any future time, bypassing the configured schedule and capacity limits.",
 "plugin": {
  "slug": "webba-booking-lite",
  "name": "Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar",
  "full_name": "Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar",
  "wordpress_org": "https://wordpress.org/plugins/webba-booking-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/webba-booking-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/webba-booking-lite"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.5.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.5.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.5.5",
 "remediation": "Update to 6.5.5 or later.",
 "fix_released": "2026-10-28T12:07:31+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:43:32.288035+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1929/",
  "https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.5/",
  "https://wordpress.org/plugins/webba-booking-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/webba-booking-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}