{"id":"CVE-2026-108123","kind":"vulnerability","aliases":["CVE-2026-108123"],"related":[],"title":"WP Booking System plugin: authorization bypass exposes customer booking emails","description":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.","summary":"The WP Booking System – Booking Calendar WordPress plugin, in all versions up to and including 2.1.0.3, does not check whether a user is allowed to read notification email logs. An unauthenticated attacker can iterate booking_id and email_log_id values to read customer names, email addresses, phone numbers, messages and booking dates.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["booking-calendar","package","pii","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Look at the installed version of the WP Booking System – Booking Calendar plugin in the WordPress admin plugins list and compare it with `2.1.0.3`\n- unknown for any other check, as the sources do not give one","fix":"- Update the WP Booking System – Booking Calendar plugin to a version later than `2.1.0.3`; the sources do not name the fixed version\n- unknown for further action, as the sources do not say","status":"open","published_at":"2026-10-17T04:16:48+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:24:47+00:00","updated_at":"2026-10-25T03:24:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:24:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WP Booking System – Booking Calendar plugin to a version later than `2.1.0.3`; the sources do not name the fixed version\n- unknown for further action, as the sources do not say","reach":"internet","title":"WP Booking System plugin: authorization bypass exposes customer booking emails","impact":"medium","summary":"The WP Booking System – Booking Calendar WordPress plugin, in all versions up to and including 2.1.0.3, does not check whether a user is allowed to read notification email logs. An unauthenticated attacker can iterate booking_id and email_log_id values to read customer names, email addresses, phone numbers, messages and booking dates.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","booking-calendar","pii"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attackers read customer names, emails, phone numbers and messages.","analyst_note":"Find the fixed plugin version and the vendor advisory; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-108123 does not name a patched release.","how_to_check":"- Look at the installed version of the WP Booking System – Booking Calendar plugin in the WordPress admin plugins list and compare it with `2.1.0.3`\n- unknown for any other check, as the sources do not give one","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Booking System – Booking Calendar plugin at version `2.1.0.3` or earlier are exposed, since the flaw is in the plugin's handling of booking email logs on admin_init. Any WordPress site with this plugin installed holds customer booking data and should check; sites without the plugin can skip it. The sources say any Subscriber-level account can trigger it, so sites that allow subscriber registration are at greater risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":3434,"output_tokens":693,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108123':13A,16A '-2026':12A,15A '2.1.0.3':41B,100C 'access':184C 'action':118C 'address':72B,150C 'admin':174C,182C 'administr':163C 'allow':49B 'attack':57B,125C 'authent':187C 'author':5A,91C,114C 'bodi':132C 'book':2A,9A,18B,28B,30B,60B,77B,81C,83C,135C,138C,155C 'booking-calendar':17B 'bypass':6A,92C 'calendar':19B,31B,84C 'check':44B 'custom':8A,69B,145C 'cve':11A,14A 'date':78B,156C 'due':103C 'email':10A,53B,63B,71B,131C,141C,149C 'exploit':166C 'expos':7A,144C 'fire':176C 'id':61B,65B,139C,143C 'includ':40B,99C,147C 'init':175C 'intend':157C 'iter':59B,137C 'level':171C 'log':54B,64B,142C 'make':120C 'messag':75B,153C 'name':70B,148C 'notif':52B,130C 'number':74B,152C 'packag':20B 'page':183C 'perform':116C 'phone':73B,151C 'pii':21B,146C 'plugin':4A,25B,33B,85C,106C 'possibl':122C 'profile.php':178C 'proper':108C 'read':51B,68B,127C 'store':129C 'subscrib':170C 'subscriber-level':169C 'system':3A,29B,82C 'unauthent':56B,124C 'user':47B,112C,172C,188C 'valu':66B 'verifi':109C 'version':36B,95C 'visibl':160C 'vulner':89C 'whether':45B 'wordpress':22B,24B,32B,87C 'wordpress-plugin':23B 'wp':1A,27B,80C,181C 'wp-admin':180C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Booking System – Booking Calendar plugin at version `2.1.0.3` or earlier are exposed, since the flaw is in the plugin's handling of booking email logs on admin_init. Any WordPress site with this plugin installed holds customer booking data and should check; sites without the plugin can skip it. The sources say any Subscriber-level account can trigger it, so sites that allow subscriber registration are at greater risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108123","severity":null,"published_at":"2026-10-17T04:16:48+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}