Wp Booking System Booking Calendar
Monthly
WP Booking System through 2.1.0.3 can disclose stored booking-notification email bodies to an authenticated Subscriber-level user because the plugin fails to verify authorization before returning log data keyed by booking_id and email_log_id. The exposed content includes customer PII such as names, email addresses, phone numbers, messages, and booking dates, but the flaw is read-only and does not permit data modification or code execution. The published vector claims PR:N, while the independent assessment corrects this to PR:L (a low-privilege account is required, trivial on sites with open registration); no public exploit identified at time of analysis.
WP Booking System - Booking Calendar through 2.1.0.3 allows an authenticated user with pre-existing per-form edit delegation to overwrite user_permission meta and grant edit access to all booking forms, including to arbitrary other users. The issue is a missing-authorization flaw (CWE-862) rated CVSS 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N); the key precondition is that an administrator must already have delegated edit rights on at least one form, which exposes the edit page and a reusable wpbs_edit_form nonce. No public exploit has been identified at time of analysis, and impact is confined to the plugin’s booking-form ACL and data rather than site-wide takeover.
Low-privilege information disclosure in the WP Booking System - Booking Calendar WordPress plugin through version 2.1.0.3, where the calendar AJAX handler fails to enforce a capability check on the 'id' parameter. Any authenticated user at subscriber level or above (PR:L, network-reachable, no user interaction) can pull private per-event booking descriptions and booking IDs from calendars they do not own. Assessed CVSS 6.5 reflects high confidentiality impact with no integrity or availability effect; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the practical risk is bounded by the need for a valid subscriber account - sites that disable open registration and have no untrusted low-privilege users are largely insulated.
Authenticated SQL injection in the WP Booking System - Booking Calendar plugin for WordPress (all versions up to and including 2.1.0.1) lets a user with Administrator-level privileges or above inject arbitrary SQL via the AJAX 'data[orderby]' parameter and read sensitive records from the site database. The attack path is constrained: the orderby value only reaches the SQL query builder when the booking AJAX handler takes the use_ajax branch, which requires the targeted calendar to contain more than 200 bookings - a non-default state that an Administrator can deliberately create. This issue is not listed in CISA KEV and no public exploit code was identified at time of analysis; a confidentiality-only impact (CVSS 4.9, PR:H, no user interaction) keeps the practical risk low-to-moderate, and the vendor has released 2.1.0.2 to fix it.
Authenticated SQL injection in WP Booking System - Booking Calendar versions up to and including 2.1.0.1 allows subscriber-level attackers to extract sensitive database information via the 'current_month' parameter. The vulnerability is a regression: a capability check added in 2.0.19.11-2.0.19.14 to fix CVE-2024-50425 was removed in version 2.1, and no nonce validation is required, so any logged-in subscriber can reach the vulnerable AJAX handler. No public exploit code or active exploitation has been identified at time of analysis, and the assessed severity is moderate (CVSS 6.5).
WP Booking System through 2.1.0.3 can disclose stored booking-notification email bodies to an authenticated Subscriber-level user because the plugin fails to verify authorization before returning log data keyed by booking_id and email_log_id. The exposed content includes customer PII such as names, email addresses, phone numbers, messages, and booking dates, but the flaw is read-only and does not permit data modification or code execution. The published vector claims PR:N, while the independent assessment corrects this to PR:L (a low-privilege account is required, trivial on sites with open registration); no public exploit identified at time of analysis.
WP Booking System - Booking Calendar through 2.1.0.3 allows an authenticated user with pre-existing per-form edit delegation to overwrite user_permission meta and grant edit access to all booking forms, including to arbitrary other users. The issue is a missing-authorization flaw (CWE-862) rated CVSS 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N); the key precondition is that an administrator must already have delegated edit rights on at least one form, which exposes the edit page and a reusable wpbs_edit_form nonce. No public exploit has been identified at time of analysis, and impact is confined to the plugin’s booking-form ACL and data rather than site-wide takeover.
Low-privilege information disclosure in the WP Booking System - Booking Calendar WordPress plugin through version 2.1.0.3, where the calendar AJAX handler fails to enforce a capability check on the 'id' parameter. Any authenticated user at subscriber level or above (PR:L, network-reachable, no user interaction) can pull private per-event booking descriptions and booking IDs from calendars they do not own. Assessed CVSS 6.5 reflects high confidentiality impact with no integrity or availability effect; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the practical risk is bounded by the need for a valid subscriber account - sites that disable open registration and have no untrusted low-privilege users are largely insulated.
Authenticated SQL injection in the WP Booking System - Booking Calendar plugin for WordPress (all versions up to and including 2.1.0.1) lets a user with Administrator-level privileges or above inject arbitrary SQL via the AJAX 'data[orderby]' parameter and read sensitive records from the site database. The attack path is constrained: the orderby value only reaches the SQL query builder when the booking AJAX handler takes the use_ajax branch, which requires the targeted calendar to contain more than 200 bookings - a non-default state that an Administrator can deliberately create. This issue is not listed in CISA KEV and no public exploit code was identified at time of analysis; a confidentiality-only impact (CVSS 4.9, PR:H, no user interaction) keeps the practical risk low-to-moderate, and the vendor has released 2.1.0.2 to fix it.
Authenticated SQL injection in WP Booking System - Booking Calendar versions up to and including 2.1.0.1 allows subscriber-level attackers to extract sensitive database information via the 'current_month' parameter. The vulnerability is a regression: a capability check added in 2.0.19.11-2.0.19.14 to fix CVE-2024-50425 was removed in version 2.1, and no nonce validation is required, so any logged-in subscriber can reach the vulnerable AJAX handler. No public exploit code or active exploitation has been identified at time of analysis, and the assessed severity is moderate (CVSS 6.5).