CVE-2026-108123: CWE-862 Missing Authorization in murgroland WP Booking System – Booking Calendar

CVE-2026-108123 is an authorization bypass vulnerability (CWE-862) in the WP Booking System – Booking Calendar WordPress plugin versions up to and including 2.1.0.3. The plugin fails to properly check if a user is authorized to perform certain actions, specifically allowing access to booking notification email bodies. This enables unauthenticated attackers or any authenticated user with Subscriber-level privileges to enumerate booking_id and email_log_id parameters to retrieve sensitive customer personally identifiable information (PII) such as names, emails, phone numbers, messages, and booking dates. The issue stems from the admin_init hook firing on profile.php, a page accessible to all authenticated users, without sufficient authorization checks.

The vulnerability allows unauthorized disclosure of sensitive customer PII stored in booking notification emails. This includes names, email addresses, phone numbers, messages, and booking dates. The exposure of this data compromises customer privacy and could facilitate further attacks such as phishing or social engineering. The CVSS 3.1 base score is 7.5 (high severity), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no impact on integrity or availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin or disable it if possible. Limit user roles and permissions to prevent Subscriber-level users from accessing wp-admin pages like profile.php. Monitor for updates from the vendor and apply official patches promptly once released.