CVE-2026-88995
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request. This allows unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
Risk Assessment
Unauthorized access to customer personal data can lead to privacy breaches and GDPR compliance issues. This may result in loss of trust and regulatory fines.
Recommendation
Update the Bookit plugin to version 2.6.0.1 or later. Check whether customer data was leaked and consider notifying affected individuals.
Other vulnerabilities in Bookit — Booking & Appointment Calendar
See all- CVE-2026-89008Unknown
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.
- CVE-2026-89007Unknown
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
Original NVD description (English source)
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.