{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wp-booking-system/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpbookingsystem:booking_calendar:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-108123"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP Booking System – Booking Calendar (\u003c= 2.1.0.3)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","wordpress","cve-2026-108123"],"_cs_type":"advisory","_cs_vendors":["WP Booking System"],"content_html":"\u003cp\u003eThe WP Booking System - Booking Calendar plugin for WordPress (versions 2.1.0.3 and earlier) contains an authorization bypass vulnerability (CVE-2026-108123) that allows authenticated users with Subscriber-level privileges to access restricted administrative data. The vulnerability exists because the plugin fails to properly verify user authorization before executing actions triggered by the admin_init hook on profile.php. By systematically iterating through booking_id and email_log_id parameters in requests to the plugin's internal endpoints, an attacker can retrieve the body content of stored notification emails. This exposure results in unauthorized access to sensitive customer PII, including names, email addresses, phone numbers, messages, and specific booking dates, which are intended to be accessible only by administrative users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a mass leak of customer PII stored within the plugin's email notification logs. This impacts WordPress sites utilizing the affected plugin version, potentially exposing data for every customer booking processed by the site. If exploited, an attacker could harvest significant volumes of contact information and booking details, leading to data privacy compliance violations and increased risk of follow-on social engineering or phishing attacks against the exposed individuals.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate the WP Booking System - Booking Calendar plugin to the latest version beyond 2.1.0.3 to remediate CVE-2026-108123.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for anomalous, sequential HTTP GET or POST requests directed at administrative pages (such as profile.php) that contain incrementing values in URL parameters like booking_id or email_log_id.\u003c/li\u003e\n\u003cli\u003eImplement strict access control lists (ACLs) on wp-admin pages if the plugin update cannot be applied immediately to mitigate unauthorized access by non-administrative users.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-17T04:48:28Z","date_published":"2026-10-17T04:48:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wp-booking-auth-bypass/","summary":"An authorization bypass vulnerability in the WP Booking System plugin allows authenticated subscribers to access sensitive booking email logs by manipulating request parameters, exposing PII.","title":"Authorization Bypass in WP Booking System - Booking Calendar","url":"https://feed.craftedsignal.io/briefs/2026-10-wp-booking-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - WP Booking System","version":"https://jsonfeed.org/version/1.1"}