CVE-2026-2230

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, and booking permissions granted by an Administrator, to modify other users' plugin settings, such as booking calendar display options, which can disrupt the booking calendar functionality for the targeted user.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Feb 18, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-2230610.0Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive CVE-2026-22317.2The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and incl CVE-2026-223128.6The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker t CVE-2026-223139.1The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injecti CVE-2026-223166.5A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based B CVE-2026-223177.2A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HT CVE-2026-223184.9A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send overs CVE-2026-223194.9A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters CVE-2026-22327.5The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' para CVE-2026-223206.5A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to tr CVE-2026-223215.3A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send an oversized or unexp CVE-2026-223227.1A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker