Live › vulnerability › CVE-2026-108123
Go to dashboardThe WP Booking System – Booking Calendar WordPress plugin, in all versions up to and including 2.1.0.3, does not check whether a user is allowed to read notification email logs. An unauthenticated attacker can iterate booking_id and email_log_id values to read customer names, email addresses, phone numbers, messages and booking dates.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WP Booking System – Booking Calendar plugin at version or earlier are exposed, since the flaw is in the plugin's handling of booking email logs on admin_init. Any WordPress site with this plugin installed holds customer booking data and should check; sites without the plugin can skip it. The sources say any Subscriber-level account can trigger it, so sites that allow subscriber registration are at greater risk.
2.1.0.3No product ranges from the sources yet.
2.1.0.32.1.0.3; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
This page as .md · .json · in your agent: get_signal("CVE-2026-108123")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.