CVE-2026-6810: CWE-639 Authorization Bypass Through User-Controlled Key in codepeople Booking Calendar Contact Form
The Booking Calendar Contact Form plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in all versions up to and including 1. 2. 63. This flaw arises from missing validation on a user-controlled key in the dex_bccf_admin_int_calendar_list. inc. php file. Authenticated users with Subscriber-level access or higher can exploit this vulnerability to access and take over other users' calendars and view associated user data. The vulnerability has a CVSS 3. 1 base score of 5. 3, indicating medium severity.
AI Analysis
Technical Summary
CVE-2026-6810 is an authorization bypass vulnerability in the Booking Calendar Contact Form WordPress plugin caused by insecure direct object reference due to missing validation on a user-controlled key. This allows authenticated users with low privileges to access and control other users' calendar data. The vulnerability affects all versions up to 1.2.63 and is tracked under CWE-639. No patch or official remediation is currently available, and no known exploits have been reported.
Potential Impact
An attacker with Subscriber-level or higher access can bypass authorization controls to take over other users' calendars and view sensitive user data associated with those calendars. This compromises user privacy and data integrity within the affected plugin. There is no indication of impact on confidentiality beyond user data exposure, nor on availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to calendar access. Avoid granting Subscriber-level or higher privileges to untrusted users. Follow updates from the vendor for any forthcoming patches or mitigations.
CVE-2026-6810: CWE-639 Authorization Bypass Through User-Controlled Key in codepeople Booking Calendar Contact Form
Description
The Booking Calendar Contact Form plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in all versions up to and including 1. 2. 63. This flaw arises from missing validation on a user-controlled key in the dex_bccf_admin_int_calendar_list. inc. php file. Authenticated users with Subscriber-level access or higher can exploit this vulnerability to access and take over other users' calendars and view associated user data. The vulnerability has a CVSS 3. 1 base score of 5. 3, indicating medium severity.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-6810 is an authorization bypass vulnerability in the Booking Calendar Contact Form WordPress plugin caused by insecure direct object reference due to missing validation on a user-controlled key. This allows authenticated users with low privileges to access and control other users' calendar data. The vulnerability affects all versions up to 1.2.63 and is tracked under CWE-639. No patch or official remediation is currently available, and no known exploits have been reported.
Potential Impact
An attacker with Subscriber-level or higher access can bypass authorization controls to take over other users' calendars and view sensitive user data associated with those calendars. This compromises user privacy and data integrity within the affected plugin. There is no indication of impact on confidentiality beyond user data exposure, nor on availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to calendar access. Avoid granting Subscriber-level or higher privileges to untrusted users. Follow updates from the vendor for any forthcoming patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-04-21T17:34:46.594Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69eb095d87115cfb68f0d954
Added to database: 4/24/2026, 6:10:37 AM
Last enriched: 4/24/2026, 6:21:13 AM
Last updated: 4/24/2026, 7:44:46 AM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.