CVE-2026-88995 in Bookit Plugin
Summary
by MITRE • 09/13/2026
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in The Bookit — Booking & Appointment Calendar WordPress plugin prior to version 2.6.0.1 represents a critical failure in access control mechanisms within the application's availability-check functionality. This flaw allows unauthenticated actors to bypass intended security restrictions and retrieve sensitive data belonging to other users. Specifically, the endpoint responsible for checking appointment availability fails to properly validate whether the requesting user has legitimate authorization to view the details of specific bookings. Consequently, an attacker can manipulate request parameters to query information about appointments that do not belong to them, leading to a severe breach of confidentiality and privacy.
From a technical perspective, this issue stems from improper object-level access control checks within the server-side logic handling availability requests. The application likely relies on client-supplied identifiers or fails to cross-reference the requester's session identity with the ownership of the requested appointment data before returning results. This lack of strict validation enables unauthorized enumeration and retrieval of private records. The exposed information includes free-text booking comments, which may contain personal preferences or sensitive context, as well as contact information such as names, email addresses, phone numbers, or physical addresses associated with other customers. Such exposure violates fundamental principles of data isolation and ensures that the principle of least privilege is not enforced at the application layer.
The operational impact of this vulnerability extends beyond mere privacy infringement. The disclosure of customer contact details and personal comments can facilitate targeted phishing attacks, social engineering campaigns, or harassment against affected individuals. For business owners utilizing the plugin, such a breach undermines trust in their booking system and may result in regulatory penalties under data protection laws like GDPR or CCPA due to the mishandling of personally identifiable information. Furthermore, the ability to view other customers' appointments could allow malicious actors to monitor competitor schedules if used by multiple businesses on shared hosting environments, although the primary risk remains the exposure of end-user personal data.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-1065 API Endpoint Misconfiguration as defined in common weakness enumerations. In terms of attack patterns, it corresponds to ATT&CK technique T1078 Valid Accounts if session hijacking is involved or more broadly to data exfiltration techniques where sensitive information is accessed without proper authorization. The lack of authentication requirements for accessing this specific endpoint exacerbates the risk, making exploitation straightforward and scalable across large user bases.
To mitigate this vulnerability, administrators must immediately update The Bookit plugin to version 2.6.0.1 or later, which addresses these access control flaws by implementing strict validation checks on availability requests. Until an upgrade is possible, temporary mitigations include restricting access to the affected endpoint via web application firewall rules that require valid authentication tokens for all booking-related API calls. Additionally, reviewing server logs for unusual patterns of availability queries can help identify potential exploitation attempts. Developers should also conduct a thorough audit of other endpoints within the plugin to ensure consistent enforcement of authorization checks across all data retrieval operations, thereby preventing similar issues in related functionalities.