CVE-2026-1431 is a missing authorization vulnerability in the Booking Calendar plugin for WordPress, affecting all versions up to and including 10.14.13. The vulnerability arises because the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function lacks a capability check, enabling unauthenticated attackers to retrieve sensitive booking information such as customer names, phone numbers, and emails. The CVSS 3.1 score is 5.3 (medium severity), reflecting the network attack vector with no privileges required and no user interaction needed. This vulnerability does not impact integrity or availability, only confidentiality of booking data.

An attacker without authentication can access sensitive customer booking information, including names, phone numbers, and email addresses. This exposure compromises the confidentiality of user data managed by the Booking Calendar plugin. There is no indication of impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected AJAX function or disabling the Booking Calendar plugin if possible to prevent unauthorized data access.