# CVE-2026-108123: WP Booking System – Booking Calendar - Authorization Bypass

> Live exploitation tracking for CVE-2026-108123 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-108123

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Murgroland WP Booking System – Booking Calendar
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** wordpress, cms

## Description

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII including names, email addresses, phone numbers, messages, and booking dates intended to be visible only to administrators. This is exploitable by any Subscriber-level user because admin_init fires on profile.php, a wp-admin page accessible to all authenticated users.

## CrowdSec analysis

[CVE-2026-108123](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-108123) is an authorization bypass vulnerability in the WP Booking System – Booking Calendar plugin for WordPress, affecting versions up to and including 2.1.0.3. Attackers with Subscriber-level access can exploit insufficient permission checks to retrieve stored booking notification emails by enumerating booking and email log IDs, exposing customer names, contact details, messages, and booking dates.

CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-108123 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/wp-admin/admin-post.php` with `wpbs_action=email_logs` and `booking_id` and `email_log_id` parameters to access stored booking notification emails. Successful requests may expose customer PII and booking details.

## Timeline

- 2026-10-17: CVE Published. CVE-2026-108123 is published to NVD.
- 2026-10-28: Rule Released. CrowdSec releases a rule to detect CVE-2026-108123 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/advisories/GHSA-2wvw-mp72-5fwj
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-108123.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-108123) follows observed exploitation activity for CVE-2026-108123. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.