Bookit Booking Appointment Calendar
Monthly
Unauthenticated information disclosure in the Bookit - Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.1) exposes appointment records belonging to other customers via the availability-check endpoint. Any unauthenticated visitor can query this endpoint and receive free-text booking comments, personal contact information, and appointment details that belong to other registered users. A publicly available proof-of-concept exploit exists (documented by WPScan), lowering the skill barrier for abuse. No active exploitation has been confirmed in CISA KEV.
Unauthenticated information disclosure in the Bookit - Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.1) exposes appointment records belonging to other customers via the availability-check endpoint. Any unauthenticated visitor can query this endpoint and receive free-text booking comments, personal contact information, and appointment details that belong to other registered users. A publicly available proof-of-concept exploit exists (documented by WPScan), lowering the skill barrier for abuse. No active exploitation has been confirmed in CISA KEV.