CVE-2026-108123: WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating bookingid and emaillogid, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admininit fires on profile.php, a wp-admin page accessible to all authenticated users.
Affected Software
Event History
Frequently Asked Questions
Who can access the exposed booking notification emails?
Unauthenticated attackers can read stored notification email bodies by iterating booking_id and email_log_id values. The issue is also exploitable by any authenticated WordPress user with the Subscriber role or higher because the affected admin_init path runs on profile.php, which Subscribers can access.
What information may be exposed?
Stored notification email bodies for bookings may disclose customer names, email addresses, phone numbers, messages, and booking dates. These emails are intended to be visible only to administrators.
Which installations are affected?
WP Booking System – Booking Calendar versions up to and including 2.1.0.3 are affected. The provided information does not identify a fixed version.