CVE-2023-24373: Wpdevart Booking Calendar

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.

Affected products

• Wpdevart Booking Calendar: before 3.2.4 (fixed in 3.2.4)

Published 2024-06-03. Last modified 2026-06-17.