Insecure Direct Object Reference Vulnerability in Booking Calendar Contact Form for WordPress

CVE-2026-6810

What is CVE-2026-6810?

The Booking Calendar Contact Form plugin for WordPress has a significant security flaw due to the lack of proper validation on a user-controlled key in the dex_bccf_admin_int_calendar_list.inc.php file. This vulnerability allows authenticated attackers with Subscriber-level access and above the ability to take over other users' calendars and access sensitive user data associated with those calendars. The vulnerability affects all versions of the plugin up to and including version 1.2.63, posing a serious risk to user privacy and data integrity.

References