This vulnerability, identified as CVE-2026-74002, is a missing authorization flaw (CWE-862) in the Booking Calendar plugin for WordPress by wpdevelop. It affects all versions up to and including 11.7. The flaw allows unauthenticated attackers to bypass access controls, potentially enabling unauthorized modification of data or actions within the plugin. The CVSS v3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to integrity, with no confidentiality or availability impact reported. There is no known exploit in the wild and no vendor patch or advisory information provided at this time.

The vulnerability allows unauthenticated attackers to bypass access controls, leading to potential unauthorized integrity modifications within the Booking Calendar plugin. There is no impact on confidentiality or availability. The medium CVSS score (5.3) reflects the moderate risk due to ease of exploitation but limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications for updates. No specific mitigation or workaround is provided in the current data.