4.8
Medium
CVE-2026-105193 The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient…
Description
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Booking Calendar 11.8 | earliest → < 11.8 | 11.8 |
Other CVEs of Booking Calendar
The 4 CVEs of Booking Calendar →
CVE-2026-105195
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user…
2.7
Low
CVE-2023-4620
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data,…
6.1
Medium
CVE-2021-25040
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before…
Not rated