4.8
Moyenne
CVE-2026-105193 The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient…
Description
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Booking Calendar 11.8 | premières → < 11.8 | 11.8 |
Autres CVE de Booking Calendar
Les 4 CVE de Booking Calendar →
CVE-2026-105195
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user…
2.7
Faible
CVE-2023-4620
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data,…
6.1
Moyenne
CVE-2021-25040
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before…
Non notée