The Booking Calendar Contact Form plugin for WordPress contains a missing authorization vulnerability in all versions up to and including 1.2.60. This flaw allows unauthenticated attackers to confirm bookings and bypass payment verification by exploiting the 'dex_bccf_ipn' parameter due to missing authorization checks in the 'dex_bccf_check_IPN_verification' function.