CVE-2026-109368 in WP Booking System Plugin
Summary
by MITRE • 10/17/2026
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The WP Booking System – Booking Calendar plugin for WordPress contains a critical vulnerability classified as Sensitive Information Exposure, affecting all versions up to and including 2.1.0.3. This flaw is specifically triggered through the id parameter within the application's request handling logic. The nature of this vulnerability allows authenticated attackers who possess subscriber-level access or higher privileges to bypass intended authorization controls. By manipulating the input parameters associated with calendar events, these users can retrieve data that should remain restricted to administrators or specific authorized personnel. This represents a significant failure in implementing proper object level security and access control mechanisms within the plugin's architecture.
From a technical perspective, the vulnerability stems from insufficient validation of user-supplied input when processing requests related to booking calendars. The application fails to verify whether the requesting user has legitimate ownership or administrative rights over the specific calendar event identified by the provided id parameter. Consequently, an attacker can iterate through various identifier values to enumerate and extract private per-event booking descriptions and unique booking IDs associated with any calendar managed on the site. This lack of proper authorization checks means that the confidentiality of sensitive operational data is compromised regardless of the user's role within the WordPress ecosystem, as long as they have at least subscriber-level access which is often granted by default to registered users or customers.
The operational impact of this vulnerability extends beyond simple data leakage. The exposure of private booking descriptions and unique identifiers can facilitate further malicious activities such as social engineering attacks against clients or staff members whose details are embedded in the descriptions. Furthermore, knowledge of specific booking IDs may aid attackers in crafting more targeted exploits against other parts of the WordPress installation that rely on these identifiers for state management or transaction processing. This undermines trust in the platform's ability to protect customer data and can lead to reputational damage and potential regulatory penalties under data protection laws such as GDPR if personal information is contained within those descriptions.
This vulnerability aligns with CWE-200, which defines Exposure of Sensitive Information to an Unauthorized Actor, and maps closely to MITRE ATT&CK technique T1530, Data from Cloud Storage Objects, in the context where internal data structures are treated as accessible resources without proper access controls. It also reflects weaknesses associated with CWE-862, Missing Authorization, indicating that the application does not enforce appropriate policies regarding which users can perform actions on specific objects. To mitigate this risk, site administrators should immediately update the WP Booking System plugin to a version newer than 2.1.0.3 where these access control checks have been corrected. Additionally, implementing strict input validation and ensuring that all API endpoints verify user permissions against resource ownership before returning data is essential for preventing similar issues in future updates or other plugins within the WordPress environment.