PT-2026-103229
CVE-2026-97079
·
Published
2026-09-24
·
Updated
2026-09-30
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Webba Booking versions prior to 6.5.1
Description
The Appointment Booking Plugin & Scheduling System – Webba Booking Calendar plugin for WordPress contains an Insecure Direct Object Reference (IDOR) issue. This occurs due to missing validation on a user-controlled key, allowing authenticated attackers with subscriber-level access or higher to perform unauthorized actions.
Recommendations
Update to a version newer than 6.5.0.
Found an issue in the description? Have something to add? Feel free to write us 👾