CVE-2026-74002 wpdevelop CVE debrief

Who should care

Defenders responsible for WordPress installations with the Booking Calendar plugin should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-74002 is a medium-severity vulnerability in the Booking Calendar plugin that allows unauthenticated access control bypass. Defenders should prioritize verification of exposure, assess the need for updates or compensating controls, and consider implementing restrictions on access to the plugin.

• Verification of Booking Calendar plugin versions and exposure is necessary to determine potential vulnerability.
• Unauthenticated access control bypass may lead to unauthorized access or modification of calendar data.
• Defenders should assess the need for updates or compensating controls to mitigate potential risks.

Technical summary

CVE-2026-74002 is a medium-severity vulnerability in the Booking Calendar plugin, version 11.7 or earlier. It allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized access or modification of calendar data.

Defensive priority

Defenders should prioritize verifying exposure of Booking Calendar installations and assessing the need for updates or compensating controls.

Recommended defensive actions

• Verify the version of the Booking Calendar plugin in use and compare it to the affected version (11.7 or earlier).
• Assess the need for an update to a patched version, if available.
• Consider implementing compensating controls, such as restricting access to the Booking Calendar plugin.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is needed to determine the scope of affected systems and required remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.