rootpwn

medium · CVSS v3 6.5

CVE-2026-109368

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to sensitive information exposure via the 'id' parameter. Authen

Overview

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to sensitive information exposure via the 'id' parameter. Authenticated users with subscriber-level access can retrieve private booking descriptions and IDs from any calendar. This flaw allows attackers to access confidential booking data on affected sites.

Description

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking descriptions and booking IDs from any calendar managed by the site.

Impact

Confidentiality is compromised as private booking details and IDs can be disclosed. The integrity of booking records is at risk if attackers manipulate or duplicate entries. Subscribers and site administrators are directly impacted, as they can view or misuse sensitive information. The vulnerability does not affect availability.

Remediation

Update the plugin to version 2.1.0.4 or later, which removes the vulnerable 'id' parameter handling. If an update is not immediately possible, restrict subscriber-level access to the calendar or disable the 'id' endpoint via a firewall rule. Verify that all booking data is encrypted in transit and at rest, and monitor logs for unauthorized access attempts.

Risk context

The vulnerability has a medium severity rating (CVSS v3 6.5) and no EPSS data is available. While it does not allow arbitrary code execution, the exposure of private booking information is significant for sites handling sensitive client data. Defenders should treat this as a moderate risk that requires timely patching.

Affected products

  • WordPress WP Booking System – Booking Calendar

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
—

WordPress Plugin SensitiveInformationExposure Authentication BookingCalendar CVE-2026-109368

← All CVEs

Related CVEs

medium

CVE-2026-111601

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely.

View analysis

medium

CVE-2026-92978

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on the trigger_bulk_action function. This makes it possible for unauthenticated attackers to force administrators to approve pending user registrations or deny arbitrary user accounts, locking targeted users out of the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. An attacker can bypass the earlier nonce check in trigger_query_actions() by supplying an empty new_role parameter, which causes that handler to return early and cede control to the unprotected trigger_bulk_action() handler; the exit() call at the end of that handler additionally prevents WordPress core's own bulk-users nonce validation from executing.

View analysis

medium

CVE-2026-100158

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.

View analysis

medium

CVE-2026-109382

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.

View analysis