EIP-2026-113597

PRE-CVE

WordPress Plugin Booking Calendar 4.1.4 - Cross-Site Request Forgery

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113597. PoCs published by Dylan Irzi.

AI-analyzed exploit summary This exploit demonstrates CSRF vulnerabilities in the Booking Calendar WordPress plugin (v4.1.4) by providing HTTP POST requests to add, delete, and approve bookings without proper anti-CSRF tokens. The PoC includes raw HTTP requests with parameters for each action.

Description

WordPress Plugin Booking Calendar 4.1.4 - Cross-Site Request Forgery

Exploits (1)

exploitdb WORKING POC
by Dylan Irzi · textwebappsphp
https://www.exploit-db.com/exploits/27399

This exploit demonstrates CSRF vulnerabilities in the Booking Calendar WordPress plugin (v4.1.4) by providing HTTP POST requests to add, delete, and approve bookings without proper anti-CSRF tokens. The PoC includes raw HTTP requests with parameters for each action.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Booking Calendar WordPress Plugin 4.1.4
No auth needed
Prerequisites: Victim must be logged into WordPress admin panel · Attacker must trick victim into submitting crafted POST requests
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026