WP Manifestindependent plugin directory
manifest / events / booking-calendar

Booking Calendar Plugin WP RegistryCritical findings · 3 findingsOpen the reportF

Hotel Booking Calendar - WordPress Plugin

by Zoltan Peter Sumegi & ChatGPT · github.com/sumegizoltan73/booking-calendar · website

★ 0stars
6release downloads
v1.0.4latest · 4mo ago

Install

Download booking-calendar-v1.0.4.zip From the v1.0.4 release on GitHub, May 31, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/sumegizoltan73/booking-calendar/releases/download/v1.0.4/booking-calendar-v1.0.4.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/sumegizoltan73/booking-calendar ↗

Hotel Booking Calendar - WordPress Plugin

Based on sumegizoltan73/agent-booking-plugin

WordPress version

The plugin was tested on WordPress 7.0.0, but it also works on earlier and future versions because it does not rely on any specific WordPress function or procedure.

How the plugin works

The plugin is a calendar-based booking system where bookings are assigned to daily slots, with some bookings spanning multiple days.

Customer details are stored with each booking, along with the booked room number or multiple room numbers. Notes, phone numbers, and email addresses can be added when creating a booking. These details are later displayed in a popup when clicking the booking slot in the calendar view. The most important booking details are also shown in a hover tooltip, but for a more comfortable display and for mobile use, the slot bar or row should be clicked or tapped. The clickable area differs depending on whether the calendar is in month view or week view.

Notes and bookings can be deleted, and separate notes can also be added to a slot, day, or date range. All of these are displayed. In the calendar view, each slot event only shows the room numbers and one of three basic color-coded statuses: FREE, BLOCKED, or BOOKED. This makes the booking system clear at first glance, including which rooms are booked for which dates.

The development team

I (Zoltan Peter Sumegi) am the development team, with artificial intelligence also involved in the development process. With the help of ChatGPT and the Codex coding agent, a significant part of the programming work is carried out by an AI system. I created and designed the foundations of the plugin with some AI assistance, consulting with ChatGPT, and I continue to develop the plugin with Codex, increasingly relying on it as well. Some development solutions produced by the AI system may be inappropriate because of imprecise task descriptions, but thanks to GitHub-based version control, these can be corrected easily. Overall, a very significant part of the development is based on ChatGPT and Codex.

The pace of development is extremely fast, so most of the functionality was completed within days. There were cases where a change I made, such as introducing multiple slots within a single day and slots spanning multiple days, disrupted the entire UI and overall behavior. Fortunately, Codex understood the task and efficiently completed the changes needed to restore correct operation.

Internationalization

The plugin translated to two languages, Hungarian and English. The Calendar control is also multi language.

Releases

Version 1.0.0 was released 2026-05-31.

Screenshots

On the author's blog

License

The program is licensed under the MIT License and may be freely used, distributed, integrated, and modified. The license text is included with the code in the LICENCE file.

Github repository

sumegizoltan73 - Booking Calendar

Third-party code

The plugin uses third-party solutions, especially the following:

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.4 latest
May 31, 2026 4mo ago
booking-calendar-v1.0.4.zip
2
v1.0.0
May 31, 2026 4mo ago
booking-calendar-1.0.0.zip
4
F grade

Security

Booking Calendar Plugin 1.0.4 · audited by WP Registry

Critical findings.

2 critical 1 high
Audited release
1.0.4
Findings
3
Worst severity
critical
Content hash
1f49f96837b59d623b1f6d99…

Findings

  • critical Public REST routes leak booking customer PII without permission_callback

    missing_permission_callback

    Several GET routes under booking-calendar/v1 omit permission_callback (public by default): calendar-slot-bookings, calendar-day-bookings, booking-search-results, calendar-slot-notes, calendar-events, room listing helpers. Handlers return customer_email, customer_phone, customer_name, and admin notes. Admin JS (assets/js/admin.js) calls these URLs directly. An unauthenticated visitor can enumerate bookings and harvest guest contact data.

    includes/routes.php:48-244

    Recommendation

    Require current_user_can('manage_options') (or a dedicated hotel-staff capability) on all admin-oriented routes; keep only intentional public booking create behind rate limits.

  • critical calendar-slot-bookings returns emails and phones for any slot_id

    information_disclosure

    booking_calendar_slot_bookings prepares SELECT of b.customer_name, b.customer_email, b.customer_phone and returns them in extendedProps with no auth check.

    includes/slots.php:1026-1125

    Recommendation

    Gate the callback with manage_options (or staff role) before querying.

  • high booking-search-results allows unauthenticated search of guest names/phones/notes

    information_disclosure

    Public GET /booking-search-results accepts search and returns matching customer_name, customer_phone, and concatenated notes for future bookings.

    includes/slots.php:1242-1321

    Recommendation

    Require authenticated staff capability on this route.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →