{
 "id": "WPSEC-2026-1930",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1930/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1930/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1930/index.md",
 "title": "Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.4 - Authenticated (Subscriber+) Missing Authorization to Connected Calendar Authorization Data Exposure",
 "description": "The Webba Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data via the wbk/v2/get-calendar-auth-data REST endpoint in all versions up to, and including, 6.5.4, due to its permission callback only checking for the 'read' capability and not verifying that the requested connected calendar belongs to the current user. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the authorization data of any connected calendar. For a connected Google calendar this includes the list of the linked Google account's calendars and signed Webba Connect authorization and revoke URLs for that calendar.",
 "plugin": {
  "slug": "webba-booking-lite",
  "name": "Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar",
  "full_name": "Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar",
  "wordpress_org": "https://wordpress.org/plugins/webba-booking-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/webba-booking-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/webba-booking-lite"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.5.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.5.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.5.5",
 "remediation": "Update to 6.5.5 or later.",
 "fix_released": "2026-10-28T12:07:31+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:43:32.288035+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1930/",
  "https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.5/",
  "https://wordpress.org/plugins/webba-booking-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/webba-booking-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}