CVE-2026-2230Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, and booking permissions granted by an Administrator, to modify other users' plugin settings, such as booking calendar display options, which can disrupt the booking calendar functionality for the targeted user.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-02-18); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Tarcísio Luchesi@P0ystick141d
Disclosure
Confira meu artigo mais recente: O CSS injection mas raro que ja encontrei-CVE-2026-2230 https://www.linkedin.com/pulse/o-css-injection-mas-raro-que-ja-tarc%25C3%25ADsio-luchesi-poystick--avp3f via @LinkedIn da um desconto, meu primeiro artigo, to aprendendo kkk
Post summary
The user shared a LinkedIn article announcing a rare CSS injection vulnerability (CVE-2026-2230) without providing proof‑of‑concept, exploit code, or patch details.
00050197
278 followersView on X
CVE@CVEnew233d
Disclosure
CVE-2026-2230 The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save func… https://www.cve.org/CVERecord?id=CVE-2026-2230
Post summary
The post announces that Booking Calendar plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to 10.14.14 via the handle_ajax_save function, providing basic technical details but no proof of exploitation or mitigation.
00000157
56.4K followersView on X

Explore more

Back to dashboard