# Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar <= 6.5.4 - Authenticated (Subscriber+) Missing Authorization to Connected Calendar Authorization Data Exposure

- **ID:** WPSEC-2026-1930
- **Plugin:** Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar (`webba-booking-lite`), https://wordpress.org/plugins/webba-booking-lite/
- **Affected versions:** all versions before 6.5.5
- **Fixed in:** 6.5.5 (Update to 6.5.5 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/webba-booking-lite
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1930/

## Description

The Webba Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data via the wbk/v2/get-calendar-auth-data REST endpoint in all versions up to, and including, 6.5.4, due to its permission callback only checking for the 'read' capability and not verifying that the requested connected calendar belongs to the current user. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the authorization data of any connected calendar. For a connected Google calendar this includes the list of the linked Google account's calendars and signed Webba Connect authorization and revoke URLs for that calendar.

## References

- https://wpsec.com/vuln/WPSEC-2026-1930/
- https://plugins.svn.wordpress.org/webba-booking-lite/tags/6.5.5/
- https://wordpress.org/plugins/webba-booking-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1930/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.