CVE-2026-89008
UnknownSummary
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.
Risk Assessment
Confidentiality breach of customer personal data, potentially leading to identity theft and legal consequences (GDPR).
Recommendation
Update the plugin to version 2.6.0.5 or later. Assess whether data leakage occurred and take appropriate GDPR steps.
Other vulnerabilities in Bookit — Booking & Appointment Calendar
See all- CVE-2026-89007Unknown
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
- CVE-2026-88995Medium
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request. This allows unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
Original NVD description (English source)
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.