{"id":"CVE-2026-109368","kind":"vulnerability","aliases":["CVE-2026-109368"],"related":[],"title":"WP Booking System plugin: subscribers can read private booking descriptions and IDs","description":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.","summary":"The WP Booking System – Booking Calendar WordPress plugin up to and including 2.1.0.3 exposes private per-event booking descriptions and booking IDs through its 'id' parameter. An attacker with a subscriber-level WordPress account can extract these details from any calendar the site manages.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-booking-system"],"not_affected_if":["patched-version","plugin-not-installed","registration-closed"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or `wp plugin get wp-booking-system --field=version` (plugin slug not confirmed by sources; treat as unknown if it differs)\n- Confirm whether subscriber or open registration is enabled on the site","fix":"- Update the WP Booking System – Booking Calendar plugin to a version later than `2.1.0.3`; the patched version is unknown from the sources\n- If no fixed release exists, deactivate the plugin or restrict account registration","status":"open","published_at":"2026-10-17T04:16:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:40+00:00","updated_at":"2026-10-25T03:57:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:57:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WP Booking System – Booking Calendar plugin to a version later than `2.1.0.3`; the patched version is unknown from the sources\n- If no fixed release exists, deactivate the plugin or restrict account registration","reach":"internet","title":"WP Booking System plugin: subscribers can read private booking descriptions and IDs","impact":"medium","summary":"The WP Booking System – Booking Calendar WordPress plugin up to and including 2.1.0.3 exposes private per-event booking descriptions and booking IDs through its 'id' parameter. An attacker with a subscriber-level WordPress account can extract these details from any calendar the site manages.","category":"package","nicknames":[],"who_cares":["wordpress","wp-booking-system","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads private booking descriptions and booking IDs from site calendars","analyst_note":"Find the patched plugin version and confirm the exact plugin slug from the NVD entry or the WordPress plugin changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or `wp plugin get wp-booking-system --field=version` (plugin slug not confirmed by sources; treat as unknown if it differs)\n- Confirm whether subscriber or open registration is enabled on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version","registration-closed"],"who_is_affected":"Sites running the WP Booking System – Booking Calendar plugin at version 2.1.0.3 or earlier are exposed, and the risk is greater where anyone can register a subscriber account. Sites without this plugin, or running a newer release, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3350,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109368':15A,18A '-2026':14A,17A '2.1.0.3':40B,96C 'access':112C 'account':63B 'attack':56B,107C 'authent':106C 'book':2A,9A,26B,30B,32B,46B,49B,76C,78C,121C,124C 'calendar':33B,70B,79C,128C 'cve':13A,16A 'descript':10A,47B,122C 'detail':67B 'event':45B,120C 'expos':41B 'exposur':88C 'extract':65B,116C 'host':22B 'id':12A,50B,53B,99C,125C 'includ':39B,95C 'inform':87C 'level':61B,111C 'make':102C 'manag':73B,129C 'packag':19B 'paramet':54B,100C 'per':44B,119C 'per-ev':43B,118C 'plugin':4A,35B,80C 'possibl':104C 'privat':8A,42B,117C 'read':7A 'self':21B 'self-host':20B 'sensit':86C 'site':72B,132C 'subscrib':5A,60B,110C 'subscriber-level':59B,109C 'system':3A,27B,31B,77C 'version':91C 'via':97C 'vulner':84C 'wordpress':23B,34B,62B,82C 'wp':1A,25B,29B,75C 'wp-booking-system':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Booking System – Booking Calendar plugin at version 2.1.0.3 or earlier are exposed, and the risk is greater where anyone can register a subscriber account. Sites without this plugin, or running a newer release, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109368","severity":null,"published_at":"2026-10-17T04:16:51+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}