Description

Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:17:06.823Z",
  "pubdate": "2026-08-18T15:17:06.823Z",
  "executiveSummary": "An Insecure Direct Object References (IDOR) vulnerability has been identified in the Booking calendar, Appointment Booking System plugin for versions <= 3.2.36. This security flaw allows unauthenticated malicious actors to access, manipulate, or extract sensitive booking data and administrative objects directly through predictable or parameter-manipulated requests. The vulnerability exposes confidential appointment records, potentially leading to unauthorized data disclosure, integrity violations, and privacy breaches across affected systems. Exploitation of this flaw requires network access to the target WordPress installation and does not demand prior authentication or elevated privileges, lowering the attack barrier significantly. Risk implications include the exposure of personally identifiable information (PII) of customers and appointment details, which can be leveraged for further targeted attacks or data extortion. Remediation requires updating the affected software to a patched version once released by the vendor, alongside implementing robust access control validation mechanisms on all direct object references.",
  "technicalDetails": "The vulnerability stems from insufficient authorization checks and a lack of proper session validation when processing requests targeting internal object references within the Booking calendar, Appointment Booking System <= 3.2.36. Specifically, the application relies on predictable or sequential identifiers, such as booking IDs or appointment hashes passed via HTTP parameters, without verifying whether the requesting entity possesses the necessary authorization to access the requested resource. The affected components handle backend queries related to appointment retrieval, modification, and deletion. Because the application fails to enforce server-side access controls mapping the user session or lack thereof to the requested object, an unauthenticated attacker can arbitrarily iterate through or tamper with the object reference parameters. The attack flow begins with the reconnaissance phase, where the attacker identifies the parameter used for referencing booking objects in HTTP GET or POST requests. Subsequently, the attacker crafts malicious requests containing sequential or guessed identifier values. Upon submission, the vulnerable component processes the request and returns the sensitive booking records or executes state-changing operations without validating authorization. The network exposure is remote, and the vulnerability is exploitable over standard HTTP/HTTPS protocols without requiring interaction from a privileged user. Post-exploitation impact encompasses unauthorized data enumeration of customer appointments, potential calendar manipulation, and compromise of operational integrity within the booking management ecosystem."
}