CVSS
3.8
CVSS v3.1
EPSS
0.2%
Exploit Prediction Score
Published
August 10, 2026
Exploitability
EPSS probability 0.2%
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).