Course Booking System CVE-2026-96886

No special conditions - remote unauthenticated exploitation against default configurations of the Course Booking System WordPress plugin (versions 7.0 through before 7.0.9). The plugin's booking-export function lacks an access-control/capability check, so any anonymous visitor reaching the export endpoint can retrieve the data. The only meaningful limiting factors are that the site must run an affected version of this specific plugin and must have stored course bookings containing customer PII; impact is confined to disclosure of already-collected booking data (name, email, billing address) with no write access or code execution.

This is a genuine but moderate-severity exposure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) is internally consistent with the description: an unauthenticated network attacker can trivially trigger a booking export that leaks customer PII (name, email, billing address), with confidentiality-only, partial impact and no integrity or availability effect. SSVC reinforces this reading - Exploitation 'none' (no observed exploitation), Automatable 'yes' (a single unauthenticated HTTP request can be scripted and mass-run against many sites), and Technical Impact 'partial' (limited data disclosure, not full system compromise). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' despite the trivial exploitability. The practical priority is elevated by the near-zero attack complexity and automatability against a WordPress plugin (a mass-scannable target class), but capped by the low, confidentiality-only impact - this is a real data-privacy/GDPR concern rather than a critical RCE. No signals conflict; the main missing data are EPSS and any independent POC confirmation.

An attacker enumerates WordPress sites running the Course Booking System plugin and sends a crafted unauthenticated request to the unprotected booking-export endpoint. The server returns a downloadable file containing the name, email address, and billing address of every customer who booked a course, which the attacker harvests for spam, phishing, or resale. No authentication or user interaction is required, and the request is easily automated across many sites; no public POC is currently identified.