CVE-2026-13328

The analytically defining feature of CVE-2026-13328 is not that a capability check was missing — it's that the nonce protecting the reservation-status action was publicly accessible. This collapses the expected boundary between authenticated and unauthenticated access in a way standard IDOR frameworks don't capture. WordPress nonces generated via wp_create_nonce() are tied to user sessions, yet this plugin's nonce propagated to the public scope, likely through wp_localize_script with a readable handle, a public AJAX handler, or direct template echo. Verify which pattern applies in the 6.0.2 patch by auditing the nonce generation site — remediation differs by root cause. The CVSS 5.3 warrants scrutiny. The CVE describes unauthenticated arbitrary reservation status changes, but the severity ceiling depends on what status changes actually trigger: email notifications, payment voids, availability calendar updates, or staff alerts. Plugins handling reservations almost never exist in isolation from notification hooks, so treat the CVSS as likely understated until the transactional ecosystem is audited. Assume downstream business logic exists and score accordingly. Before marking this low-priority based on the 5.3, consider the enumeration surface. Exploitation requires knowing valid reservation IDs. If the plugin uses sequential integers, every unauthenticated visitor can enumerate the reservation history and toggle any reservation — that's an infrastructure-level availability attack, not a medium-severity issue. If IDs are UUIDs or otherwise opaque, blast radius shrinks to targeted exploitation only. Verify the ID generation pattern before deprioritizing. Finally, verify the 6.0.2 fix actually removed the public nonce exposure rather than merely adding a capability check on top of it. Historical precedent shows developers often 'secure' these handlers incorrectly — leaving the nonce accessible while adding current_user_can(), which doesn't close the underlying vector. Audit the handler to confirm nonce generation was relocated or removed entirely, not just augmented.

Reviewed through automated stages and approved by a human before publication.