WordPress Booking Calendar plugin <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action vulnerability

Unauthenticated Sensitive Information Exposure in 'WPBCFLEXTIMELINENAV' AJAX Action vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Booking Calendar versions = 11.4.3...

CVE-2025-14146: Missing Authorization

The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the WPBCFLEXTIMELINENAV AJAX action. This is due to the nonce verification being conditionally disabled by default bookingisnonceatfrontend option is 'Off' ...