CVE-2026-73395 Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking…

Description

Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.

Affected products and versions

Product	Affected versions	Fixed in
Booking calendar, Appointment Booking System 3.2	earliest → 3.2.36	No fix stated

Other CVEs of Booking calendar, Appointment Booking System

The 14 CVEs of Booking calendar, Appointment Booking System →

CVE-2026-8840 The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all… 5.3 Medium CVE-2026-57778 Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows… 5.3 Medium CVE-2026-15289 The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via… 5.9 Medium CVE-2026-25435 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking… 7.1 High