CVE-2026-1431: Wpdevelop Booking Calendar

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.

Affected products

• Wpdevelop Booking Calendar: up to and including 10.14.13

Published 2026-01-31. Last modified 2026-06-17.