CVE-2026-108123
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.3 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII.
Risk Assessment
Exposure of customer PII (names, email addresses, phone numbers, messages, booking dates) may lead to GDPR violations and use of the data for phishing attacks.
Recommendation
Update the WP Booking System plugin to a version newer than 2.1.0.3; until then, consider restricting wp-admin access for low-privileged users.
Other vulnerabilities in WP Booking System
See all- CVE-2026-57639High
The WP Booking System plugin by Roland Murg up to 2.1.0.6 does not properly neutralize input during web page generation, allowing a Reflected XSS attack. The issue affects versions from n/a through 2.1.0.6.
- CVE-2026-57367High
The WP Booking System plugin versions below 5.12.8.1 contain a Broken Access Control vulnerability that allows subscribers unauthorized access to functions.
Original NVD description (English source)
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS