GCVE - cpe:2.3:a:imznarf:booking_calendar_and

Approved changes feed: RSS · Atom

cpe:2.3:a:imznarf:booking_calendar_and_notification:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Imznarf (`d8880834-51d7-59a0-8988-7c19ffe86de6`)
Product	Booking Calendar And Notification (`70b4a89c-dd03-5ccc-9078-0b6face3df6a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-13746`	vulnerable	2026-06-08 06:25:38.454306	Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions MEDIUM (6.5) The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on the wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() functions in all versions up to, and including, 4.0.3. This makes it possible for unauthenticated attackers to extract data, create or update bookings, or delete arbitrary posts. Published: 2025-03-01T04:21:48.626Z Updated: 2026-04-08T16:48:50.781Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/422bb9a5-c848-4492-add7-bc65b1111565?source=cve https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/tags/4.0.3/lib/includes/function.php https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L270 https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L134 https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L188	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.