Live › vulnerability › CVE-2026-109368
Go to dashboardThe WP Booking System – Booking Calendar WordPress plugin up to and including 2.1.0.3 exposes private per-event booking descriptions and booking IDs through its 'id' parameter. An attacker with a subscriber-level WordPress account can extract these details from any calendar the site manages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WP Booking System – Booking Calendar plugin at version 2.1.0.3 or earlier are exposed, and the risk is greater where anyone can register a subscriber account. Sites without this plugin, or running a newer release, can skip it.
No product ranges from the sources yet.
wp plugin get wp-booking-system --field=version (plugin slug not confirmed by sources; treat as unknown if it differs)2.1.0.3; the patched version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-109368")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.