CVE-2026-108123
Received Received - Intake

Authorization Bypass in WP Booking System WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-108123
EUVD
EUVD-2026-103228

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
murgroland WP Booking System – Booking Calendar 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Booking System – Booking Calendar plugin for WordPress has an authorization bypass vulnerability in versions up to 2.1.0.3. The plugin fails to verify user authorization for actions, allowing unauthenticated attackers to access sensitive customer data by manipulating booking and email IDs. This exposes personally identifiable information (PII) such as names, email addresses, phone numbers, messages, and booking dates that should only be visible to administrators.

Detection Guidance

Check WordPress installations for the WP Booking System – Booking Calendar plugin versions up to 2.1.0.3. Look for unauthorized access to booking data or admin_init hooks triggering on profile.php. Review server logs for unusual requests iterating booking_id or email_log_id.

Impact Analysis

If you use this plugin, attackers could exploit this flaw to steal customer data, including PII, without needing authentication. This could lead to privacy breaches, identity theft, or misuse of customer information. The vulnerability is particularly dangerous because it affects all versions up to 2.1.0.3 and can be exploited by any Subscriber-level user.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to PII. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations handling sensitive data.

Mitigation Strategies

Update the WP Booking System – Booking Calendar plugin to the latest version beyond 2.1.0.3. If an update is unavailable, disable the plugin immediately. Restrict Subscriber-level user access to wp-admin pages and review all booking data for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108123. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart