CVE-2024-13821 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation

What is CVE-2024-13821?

CVE-2024-13821 is a medium-severity vulnerability in wpdevelop Booking Calendar, published on 12 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This makes it possible for unauthenticated attackers to manipulate their confirmed bookings, even after they have been approved.

Weakness: CWE-285

Which versions are affected by CVE-2024-13821?

It affects 1 product.

Products include Wpbookingcalendar Booking Calendar.

How do I fix CVE-2024-13821?

No fix has been published for CVE-2024-13821 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-13821 being exploited?

There is no known exploitation of CVE-2024-13821 in the wild and no public exploit code.

Other vulnerabilities in wpdevelop Booking Calendar

• CVE-2024-1207 Booking Calendar <= 9.9 - Unauthenticated SQL Injection Critical 9.8
• CVE-2023-51520 WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS) Medium 6.5
• CVE-2024-6930 WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode Medium 6.4
• CVE-2023-4620 Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS Medium 6.1
• CVE-2022-33177 WordPress Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) vulnerabiulity Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qw84-q4qh-xxpc.