# Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.4 - Authenticated (Subscriber+) Improper Input Validation to Booking Rescheduling Into Unavailable Timeslots

- **ID:** WPSEC-2026-1929
- **Plugin:** Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar (`webba-booking-lite`), https://wordpress.org/plugins/webba-booking-lite/
- **Affected versions:** all versions before 6.5.5
- **Fixed in:** 6.5.5 (Update to 6.5.5 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/webba-booking-lite
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1929/

## Description

The Webba Booking Calendar plugin for WordPress is vulnerable to improper input validation via the wbk/v2/update-booking REST endpoint in all versions up to, and including, 6.5.4, due to the update_booking() function saving the requested booking time without checking that it is an existing timeslot of the booking's service with enough free places. This makes it possible for authenticated attackers, with subscriber-level access and above, to move bookings made with their own email address to any future time, bypassing the configured schedule and capacity limits.

## References

- https://wpsec.com/vuln/WPSEC-2026-1929/
- https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.5/
- https://wordpress.org/plugins/webba-booking-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1929/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.