rootpwn

low · CVSS v3 3.7 · EPSS 0.00156

CVE-2026-39601

WPdevelop Booking Calendar plugin contains a race condition that can be triggered by concurrent booking requests, potentially allowing unaut

Overview

WPdevelop Booking Calendar plugin contains a race condition that can be triggered by concurrent booking requests, potentially allowing unauthorized manipulation of booking data. The flaw exists in all versions up to 11.8.4 and may lead to data corruption or service disruption.

Description

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.

Impact

Confidentiality: possible exposure of booking details. Integrity: unauthorized modification of booking records. Availability: potential service disruption due to corrupted data. Defenders: WordPress site administrators and plugin maintainers.

Remediation

Update Booking Calendar to version 11.8.5 or later. If an update is not immediately possible, disable concurrent booking submissions or implement request throttling to mitigate race conditions. Apply any vendor‑provided patch or configuration change that enforces proper synchronization.

Risk context

The CVSS v3 score of 3.7 and an EPSS of 0.00156 indicate a very low likelihood of exploitation; this vulnerability is low priority but should still be addressed in routine maintenance.

Affected products

  • WPdevelop Booking Calendar

Scores

Severity
low
CVSS v2
2.6
CVSS v3
3.7
CVSS v4
—
EPSS
0.00156

race condition booking-calendar wp-plugin low-severity wpdevelop confidentiality integrity availability

← All CVEs

Related CVEs

low

CVE-2026-86834

The MetForm WordPress plugin (v<4.3.1) writes a debug file to the web root whenever HubSpot Forms integration is enabled. The file is accessible to unauthenticated users, exposing upstream API response data, correlation IDs, and cookies. This can aid attackers in gathering sensitive information about the site’s integration.

View analysis

low

CVE-2026-96962

The Pie Register WordPress plugin (v3.8.4.13 and earlier) fails to restrict access to its invitation‑code report. An unauthenticated attacker who knows a valid invitation code can retrieve the usernames and email addresses of all users who registered with that code. This exposes personal data and can aid further phishing or credential‑replay attacks.

View analysis

low

CVE-2026-105083

ImageMagick versions prior to 7.1.2-32 and 6.9.13-57 can silently ignore security policy rules when policy.xml uses an alternate DOCTYPE that does not end with "]>", allowing restricted operations to be performed. This policy bypass can enable attackers to execute actions normally blocked by ImageMagick’s security policies. The vulnerability is low severity but still poses a risk to systems that rely on strict policy enforcement.

View analysis

low

CVE-2026-104994

Trivy, a popular open-source vulnerability scanner, has a directory traversal flaw in Terraform filesystem functions. The bug allows an attacker to read files outside the intended scan root when scanning untrusted Terraform configurations. This can expose sensitive data in scan results.

View analysis