ByteOS Network

CVE Vulnerability Details :

CVE-2026-6810

PUBLISHED

More Info Official Page

Assigner-Wordfence

Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599

Published At-24 Apr, 2026 | 05:29

Updated At-24 Apr, 2026 | 13:55

▼CVE Numbering Authority (CNA)

Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user's calendars and view user data associated with the calendar.

Affected Products

Vendor

CodePeople

Product

Booking Calendar Contact Form

Default Status

unaffected

Versions

Affected

From 0 through 1.2.63 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-639	CWE-639 Authorization Bypass Through User-Controlled Key

Type: CWE

CWE ID: CWE-639

Description: CWE-639 Authorization Bypass Through User-Controlled Key

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Credits

finder

Md. Moniruzzaman Prodhan

Timeline

Event	Date
Vendor Notified	2026-04-21 17:49:57
Disclosed	2026-04-23 16:30:20

Event: Vendor Notified

Date: 2026-04-21 17:49:57

Event: Disclosed

Date: 2026-04-23 16:30:20

References

Hyperlink	Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/a3977d10-239d-4b83-ab0c-ad165485498d?source=cve	N/A
https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/trunk/dex_bccf_admin_int_calendar_list.inc.php#L38	N/A
https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/tags/1.2.63/dex_bccf_admin_int_calendar_list.inc.php#L38	N/A
https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/trunk/dex_bccf_admin_int_calendar_list.inc.php#L71	N/A
https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/tags/1.2.63/dex_bccf_admin_int_calendar_list.inc.php#L71	N/A
https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/trunk/dex_bccf.php#L608	N/A
https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/tags/1.2.63/dex_bccf.php#L608	N/A
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3512197%40booking-calendar-contact-form&new=3512197%40booking-calendar-contact-form&sfp_email=&sfph_mail=	N/A