Missing Authorization Vulnerability in Booking Calendar Contact Form Plugin for WordPress

CVE-2025-13318

What is CVE-2025-13318?

The Booking Calendar Contact Form plugin for WordPress is susceptible to an unauthorized access issue due to a lack of necessary authorization checks in the 'dex_bccf_check_IPN_verification' function. This vulnerability enables unauthenticated attackers to bypass payment verification and arbitrarily confirm bookings by manipulating the 'dex_bccf_ipn' parameter. All versions up to and including 1.2.60 are affected.

References