CVE-2025-13318 identifies a missing authorization vulnerability (CWE-862) in the Booking Calendar Contact Form plugin for WordPress, affecting all versions up to 1.2.60. The issue arises from the lack of authorization checks and payment verification in the dex_bccf_check_IPN_verification function. This allows unauthenticated attackers to arbitrarily confirm bookings and bypass payment requirements by exploiting the 'dex_bccf_ipn' parameter. The vulnerability is remotely exploitable without privileges or user interaction and has a CVSS 3.1 base score of 5.3 (medium severity). No patch or official fix has been documented in the provided data.

An attacker can confirm bookings without completing payment, potentially leading to unauthorized bookings and financial loss for the site owner. The vulnerability does not impact confidentiality or availability but impacts integrity by allowing unauthorized booking confirmations. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the affected plugin functionality to trusted users only. Monitor for updates from the vendor codepeople regarding patches or official mitigations.