WP Booking System EUVD-2026-103228

Exploitation requires the target site to be running WP Booking System - Booking Calendar at or below version 2.1.0.3 with existing bookings that have generated notification email logs. The attacker needs an authenticated session at Subscriber level or higher (per the description, the authorization check is missing on the admin_init hook that fires on wp-admin/profile.php, which all authenticated users can reach); on sites permitting open user registration this bar is effectively trivial. The attacker must then enumerate two integer identifiers, booking_id and email_log_id, to retrieve each stored email body. Limiting factors: the CVSS vector's PR:N (unauthenticated) claim is contradicted by the Subscriber-level requirement, so a valid low-privilege account is in practice needed; no special plugin configuration is required beyond having booking notification logs present, and impact is confined to disclosure of stored PII (no write or code-execution capability).

The CVSS base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N, implying a network-reachable, low-complexity flaw. However, the signals conflict and must be weighed carefully. The CVSS vector claims PR:N (unauthenticated), yet the description's own explanation states the issue is 'exploitable by any Subscriber-level user because admin_init fires on profile.php' - a wp-admin page requiring an authenticated session. This is a genuine contradiction: the mechanism described is authenticated (Subscriber-level), so true no-auth exploitation is doubtful and the effective privilege requirement is likely PR:L, not PR:N - verify with the vendor. Impact is confidentiality-only (C:H, I:N, A:N): disclosure of customer PII (names, emails, phone numbers, messages, booking dates), with no integrity or availability effect, so this is an information-disclosure/IDOR-class issue rather than a path to code execution. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public POC was supplied, so there is no evidence of active or at-scale exploitation. SSVC inputs (exploitation status, automatable, technical impact) were not provided and cannot be assessed. Net: this is a real and actionable PII-exposure bug with regulatory (GDPR/privacy) consequences and trivial technical complexity, but it is not a top-tier emergency - absent KEV/EPSS/POC signals it ranks as a prompt-patch item rather than a drop-everything priority, and the real privilege bar is probably a low-privilege authenticated account rather than fully unauthenticated.

An attacker obtains any low-privilege (Subscriber) account - trivial on sites that allow open registration - and navigates to wp-admin/profile.php, where the plugin's admin_init hook runs without an authorization check. They then script iteration over booking_id and email_log_id values to dump the stored notification email bodies for every booking, harvesting customer PII. No public exploit code was identified at time of analysis; attack complexity is low given the predictable, enumerable identifiers.