CVE-2026-108123
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.3 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII.
Risk Assessment
Exposure of customer PII (names, email addresses, phone numbers, messages, booking dates) may lead to GDPR violations and use of the data for phishing attacks.
Recommendation
Update the WP Booking System plugin to a version newer than 2.1.0.3; until then, consider restricting wp-admin access for low-privileged users.
Other vulnerabilities in WP Booking System
Original NVD description (English source)
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS