Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-26T06:16:24.910Z",
  "pubdate": "2026-08-26T06:16:24.910Z",
  "executiveSummary": "The Booking for Appointments and Events Calendar plugin for WordPress, in versions prior to 2.4.7, is susceptible to an unauthenticated functional bypass vulnerability.\nThe vulnerability resides in the plugin's notification processing mechanism, which fails to enforce access control checks on the internal queue dispatch logic.\nBy sending a crafted request to the endpoint responsible for processing pending notifications, an unauthenticated attacker can force the system to dispatch queued emails and trigger integration callbacks prematurely or repeatedly.\nThis vulnerability poses a significant risk to organizational communication integrity, potentially leading to information disclosure, spamming of end-users, or the unauthorized execution of third-party integration webhooks.\nNo authentication or elevated privileges are required to initiate this process, making the attack surface publicly accessible to any network-adjacent actor.\nThe primary risk implications involve the forced consumption of notification quotas, potential leakage of sensitive appointment data via improperly configured callbacks, and the degradation of trust with system users through unexpected administrative communication.",
  "technicalDetails": "The vulnerability is rooted in a broken access control flaw within the Booking for Appointments and Events Calendar plugin's internal task runner or notification handler component. In versions earlier than 2.4.7, the plugin architecture exposes a specific endpoint or hook—designed for background task management—that lacks the necessary authentication middleware or security nonces to restrict execution to authorized administrative sessions.\nThe root cause is the absence of validation checks (e.g., current_user_can() or check_admin_referer()) within the logic that processes the pending notification queue. Because the plugin does not verify the identity of the requester, any HTTP request directed toward the specific dispatch controller forces the application to iterate through the queue table and execute the pending actions defined therein.\nThe attack flow proceeds as follows: First, the attacker identifies the URI pattern or action hook responsible for triggering the background processing of notifications. Second, the attacker sends a standard GET or POST request to this endpoint. Third, the plugin, failing to verify the session or permissions, invokes its notification engine. This engine iterates through all items currently in the 'pending' state within the plugin's database tables. Finally, the application dispatches these notifications to the intended recipients or executes the registered integration callbacks, such as webhooks linked to external CRM or payment platforms.\nThis behavior facilitates unauthorized dispatching, which can be leveraged to deplete email service quotas or perform reconnaissance against third-party integrations by observing callback responses if the integration is improperly secured. Furthermore, if the notification queue contains sensitive data or triggers actions that alter the state of connected external services, an attacker can manipulate these business processes without authorization. The exposure is total in terms of network reachability, as any unauthenticated user capable of reaching the WordPress installation can trigger the event, bypassing any logical boundary meant to segregate administrative functions from public traffic.\nThe lack of rate limiting or authentication on this sensitive administrative function allows for automated exploitation, potentially enabling an attacker to cycle through the queue repeatedly if notifications are not properly flagged as 'processed' within the database or if the handler fails to implement robust transaction locking."
}