CVE-2026-2230 is an insecure direct object reference vulnerability in the Booking Calendar WordPress plugin (up to version 10.14.14). The issue is due to insufficient validation of a user-controlled key in the handle_ajax_save function, allowing authenticated users with certain permissions to alter other users' plugin settings. This authorization bypass can affect booking calendar display configurations, potentially disrupting user experience. The vulnerability requires at least Subscriber-level access with booking permissions and does not impact confidentiality or availability, only integrity of settings.

An authenticated attacker with Subscriber-level access and granted booking permissions can modify other users' booking calendar settings. This may disrupt the booking calendar functionality for those users but does not lead to data confidentiality loss or system availability impact. The integrity of plugin settings is compromised, which could affect user experience and booking operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict booking permissions carefully and limit Subscriber-level users' capabilities to prevent unauthorized modifications. Monitor plugin updates from wpdevelop for a security patch addressing this vulnerability.