Low · 3.7 CVE-2026-39601 EUVD-2026-91664GHSA-c83g-wfv6-9ghj

WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability

Published Oct 2, 2026 · Updated Oct 5, 2026 · Assigned by Patchstack

Vendor: wpdevelop Product: Booking Calendar

Description

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.

Affected products

Vendor	Product	Affected	Fixed
WPdevelop	Booking Calendar	≤ 11.8.4	—

References

https://patchstack.com/database/wordpress/plugin/booking/vulnerability/wordpress-booking-calendar-plugin-11-8-4-race-condition-vulnerability?_s_id=cve vdb-entry