CVE-2026-108123 Details

A vulnerability exists in the WP Booking System – Booking Calendar plugin for WordPress, in all versions through 2.1.0.3. The issue stems from the plugin's failure to properly verify user authorization for certain actions. This flaw enables unauthenticated attackers to access the notification email bodies of bookings by manipulating booking_id and email_log_id, thereby exposing personal customer information such as names, email addresses, phone numbers, messages, and booking dates, which are meant to be confidential and only visible to administrators. This vulnerability can be exploited by any user with Subscriber-level access, as the admin_init action is triggered on profile.php, a wp-admin page available to all authenticated users.

Users are advised to update the WP Booking System – Booking Calendar plugin to version 2.1.0.4 or later.