CVE-2026-105193 Details
Description
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
A vulnerability exists in the Booking Calendar WordPress plugin in versions prior to 11.8, where the per-booking access hashes are generated with insufficient entropy. The hashes are derived from a low-entropy, time-seeded value, allowing unauthenticated attackers who can ascertain a booking's creation time to predict the hash. This predictability could lead to unauthorized access to the booking's personal data or allow modifications to the booking.
Users are advised to update the Booking Calendar WordPress plugin to version 11.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/c6a81cf3-095d-4d7e-83c5-80f44327e7fe/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-326 | Inadequate Encryption Strength | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Booking Calendar | < 11.8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |