CVE-2026-39601 describes a race condition vulnerability in the WPdevelop Booking Calendar booking plugin, present in versions up to 11.8.4. The issue arises from improper synchronization when multiple processes access a shared resource concurrently, potentially leading to integrity violations. The CVSS 3.1 base score is 3.7, reflecting a low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

The vulnerability could allow an attacker to cause integrity issues by exploiting race conditions in the booking plugin. There is no impact on confidentiality or availability. The low CVSS score and absence of known exploits indicate limited immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, cautious use of the affected plugin version is advised. No specific mitigations are provided by the vendor at this time.