CVE-2026-6810 is an authorization bypass vulnerability in the Booking Calendar Contact Form WordPress plugin caused by insecure direct object reference due to lack of validation on a user-controlled key. This allows authenticated users with minimal privileges (Subscriber and above) to access and take over other users' calendars and view their data. The issue exists in the dex_bccf_admin_int_calendar_list.inc.php file and affects all versions up to 1.2.63. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or official remediation has been published by the vendor as of the current information.

An attacker with Subscriber-level access or higher can exploit this vulnerability to bypass authorization controls and gain access to other users' calendars and their associated data. This could lead to unauthorized disclosure of user information and potential misuse of calendar data. There is no indication of impact on confidentiality beyond user data exposure, nor on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit user roles and privileges to trusted users only and monitor for suspicious activity related to calendar access. Avoid granting Subscriber-level access to untrusted users. Follow updates from the vendor for any forthcoming patches or mitigations.