The Booking Calendar plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) that permits authenticated attackers with Subscriber-level privileges or above to access sensitive booking records belonging to other users. This unauthorized access leads to exposure of personally identifiable information stored in the booking database. The vulnerability affects all plugin versions up to 10.14.11. The CVSS 3.1 base score is 4.3, reflecting a medium impact primarily due to confidentiality loss without integrity or availability impact. No known exploits in the wild have been reported, and no patch or official remediation guidance is currently documented.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable Booking Calendar plugin can view sensitive booking information of other users. This includes personal details such as names, email addresses, phone numbers, physical addresses, payment status, booking costs, and booking hashes. The confidentiality of user data is compromised, but there is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and consider disabling or replacing the Booking Calendar plugin if sensitive booking data exposure is a concern.