CVE-2024-13746 is a missing authorization vulnerability in the Booking Calendar and Notification plugin for WordPress, affecting all versions up to 4.0.3. The issue arises because the functions wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() lack proper capability checks, enabling unauthenticated attackers to extract booking data, create or update bookings, or delete arbitrary posts. The vulnerability is classified under CWE-862 and has a CVSS 3.1 score of 6.5 (medium severity). No patch or official fix information is currently available, and the plugin is not a cloud service, so remediation depends on the vendor providing an update.

An attacker without authentication can access sensitive booking data, modify existing bookings, or delete posts arbitrarily within the affected WordPress plugin. This could lead to data confidentiality and integrity breaches. There is no indication of impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin and monitor for suspicious activity. Avoid using affected versions in production environments if possible. Do not rely on generic mitigations as this vulnerability specifically involves missing authorization checks in plugin functions.