---
id: "CVE-2026-109368"
kind: "vulnerability"
aliases: ["CVE-2026-109368"]
title: "WP Booking System plugin: subscribers can read private booking descriptions and IDs"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-booking-system"]
not_affected_if: ["patched-version", "plugin-not-installed", "registration-closed"]
published_at: "2026-10-17T04:16:51+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:57:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109368", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# WP Booking System plugin: subscribers can read private booking descriptions and IDs

The WP Booking System – Booking Calendar WordPress plugin up to and including 2.1.0.3 exposes private per-event booking descriptions and booking IDs through its 'id' parameter. An attacker with a subscriber-level WordPress account can extract these details from any calendar the site manages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or `wp plugin get wp-booking-system --field=version` (plugin slug not confirmed by sources; treat as unknown if it differs)
- Confirm whether subscriber or open registration is enabled on the site

## Fix

- Update the WP Booking System – Booking Calendar plugin to a version later than `2.1.0.3`; the patched version is unknown from the sources
- If no fixed release exists, deactivate the plugin or restrict account registration

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109368

## From the sources

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_