CVE-2026-96886: Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export
Published Sep 30, 2026
·Updated
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.
Affected Software
1 affected component
Course Booking System<7.0.9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Course Booking Systemto a version that resolves this vulnerability.Fixed in 7.0.9
Event History
Sep 30, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What information can an unauthenticated attacker obtain?
An attacker can download the booking export containing the name, email address, and billing address of every customer who has booked a course.
2
Does exploitation require a WordPress account or prior access?
No. The vulnerable booking export is accessible without authentication.
3
Which installations are affected?
Course Booking System versions before 7.0.9 are affected.