Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.4 - Authenticated (Subscriber+) Missing Authorization to Connected Calendar Authorization Data Exposure
- ID
- WPSEC-2026-1930
- Plugin
- Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar (webba-booking-lite)
- Affected
- all versions before 6.5.5
- Remediation
- Update to 6.5.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The Webba Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data via the wbk/v2/get-calendar-auth-data REST endpoint in all versions up to, and including, 6.5.4, due to its permission callback only checking for the 'read' capability and not verifying that the requested connected calendar belongs to the current user. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the authorization data of any connected calendar. For a connected Google calendar this includes the list of the linked Google account's calendars and signed Webba Connect authorization and revoke URLs for that calendar.
References
- https://wpsec.com/vuln/WPSEC-2026-1930/
- https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.5/
- https://wordpress.org/plugins/webba-booking-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS