WP Booking System CVE-2026-109368

Requires a valid authenticated account at subscriber level or above (PR:L) on a WordPress site running WP Booking System - Booking Calendar <= 2.1.0.3; exploitation is performed by supplying a chosen value to the 'id' parameter of the plugin's calendar AJAX action, which fails to enforce an authorization/capability check. No user interaction, no admin privileges, and no non-default plugin configuration are required. The principal limiting factor is the authentication requirement: sites that do not permit untrusted self-registration and have no low-privilege users are largely insulated, since an attacker must first obtain a subscriber account. Impact is limited to disclosure of booking descriptions and booking IDs - there is no write, modify, or service-disruption capability.

This is a genuine but mid-tier priority, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a remotely reachable, low-complexity information-disclosure flaw (CWE-862, Missing Authorization) requiring only subscriber-level authentication and no user interaction. The impact is confidentiality-only (C:H, I:N, A:N) - no code execution, data tampering, or availability loss. No EPSS score was provided, there is no CISA KEV listing (not actively exploited), and no public exploit/POC is referenced, so the signals are consistent: a straightforward-to-abuse but non-destructive bug with no evidence of in-the-wild use. The main risk driver is the low barrier (any registered subscriber on sites that allow open registration) rather than exploitation momentum. Real-world severity hinges on whether affected sites allow self-registration and on the sensitivity of the booking descriptions exposed; against sites with no untrusted accounts the practical risk drops considerably.

An attacker registers (or already holds) a low-privilege subscriber account on a WordPress site running WP Booking System 2.1.0.3 or earlier, then issues the plugin's calendar AJAX request while manipulating the 'id' parameter. Because the endpoint lacks a proper authorization/capability check, the server returns private per-event booking descriptions and booking IDs from any calendar on the site, letting the attacker harvest booking data they should never see. No public exploit code is identified at time of analysis, and exploitation is network-based with low complexity and no user interaction.