CVE-2026-105193
Medium
Description
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
SeverityMedium
CVSS4.8
Exploit probability—
ProductBooking Calendar
PublishedOct 8, 2026
First seenOct 8, 2026
Weakness typeCWE-326CWE-326
How to fix
Update
- Booking Calendar11.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Booking Calendar | v < 11.8 | 11.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.