WP Booking System – Booking Calendar - Authorization Bypass (CVE-2026-108123)
Description
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.
psychologyCrowdSec Analysis
CVE-2026-108123 is an authorization bypass vulnerability in the WP Booking System – Booking Calendar plugin for WordPress, affecting versions up to and including 2.1.0.3. Attackers with Subscriber-level access can exploit insufficient permission checks to retrieve stored booking notification emails by enumerating booking and email log IDs, exposing customer names, contact details, messages, and booking dates.
CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-108123 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target /wp-admin/admin-post.php with wpbs_action=email_logs and booking_id and email_log_id parameters to access stored booking notification emails. Successful requests may expose customer PII and booking details.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-10-17 |
| Rule Released | 2026-10-28 |