CVE-2025-68515
Sensitive Data Exposure via Insertion in WP Booking System
Publication date: 2026-03-05
Last updated on: 2026-03-10
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| roland_murg | wp_booking_system | to 2.0.19.12 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68515 is a Sensitive Data Exposure vulnerability in the WordPress WP Booking System Plugin versions up to and including 2.0.19.12.
This vulnerability allows unauthenticated attackers to access sensitive information that is normally restricted from regular users.
It falls under the OWASP Top 10 category A3: Sensitive Data Exposure.
The vulnerability requires no privileges to exploit, making it accessible to anyone.
How can this vulnerability impact me? :
This vulnerability can allow attackers to retrieve embedded sensitive data from the WP Booking System plugin.
Since the vulnerability can be exploited without any authentication, it increases the risk of unauthorized data disclosure.
Exposure of sensitive information could potentially enable further exploitation of other system weaknesses.
The CVSS severity score is 5.8, indicating a low priority threat with limited impact, but it still poses a security risk.
Users are advised to update to version 2.0.19.13 or later to mitigate this risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in the WP Booking System plugin, you should update the plugin to version 2.0.19.13 or later, where the issue has been patched.
Additionally, using automated update tools like those offered by Patchstack can help ensure rapid protection by keeping vulnerable plugins up to date.