WP Booking System – Booking Calendar Security & Risk Analysis

The wp-booking-system plugin v2.0.19.13 presents a mixed security posture. While it demonstrates some good practices like a significant number of nonce and capability checks, and a majority of SQL queries utilizing prepared statements, there are notable areas of concern. The static analysis reveals an attack surface of 15 entry points, with 3 AJAX handlers lacking proper authentication checks. This is a significant risk, as these handlers could be exploited by unauthenticated users.

Furthermore, the taint analysis highlights one high-severity flow with unsanitized paths, indicating potential for vulnerabilities if user input is not properly handled. The plugin's vulnerability history, with 7 known CVEs including one critical and six medium severity, and a recent one in 2026, suggests a recurring pattern of security weaknesses. The common types of vulnerabilities (Exposure of Sensitive Information, XSS, Missing Authorization, CSRF) reinforce the need for careful review and remediation of identified issues. The fact that there are currently no unpatched CVEs is a positive sign, but the history points to a plugin that has historically been susceptible to various attack vectors.

In conclusion, while the plugin has implemented some security measures, the presence of unprotected entry points, a high-severity taint flow, and a history of significant vulnerabilities necessitate caution. Developers should prioritize addressing the unauthenticated AJAX handlers and the identified taint flow. Ongoing vigilance and regular security audits are recommended for this plugin.